f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 16:42

Target

f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe
Size

268KB
MD5

836b3594ba1b53c0fe9334aebf2b149b
SHA1

1803e4ff9f79d254e3f187aa6d2ef9ab43c70f1d
SHA256

f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831
SHA512

21fb0c666a501ab0bade3b2ee88dacde9928fc7401f0870a54417d60a4f1139392c4a9a9afcdde3826f49c65ef76c18466f9f7b7e3373449a01ce7c500631d72
SSDEEP

6144:khK6u1JtZ9Ggp2QDm3Oezv/ucx44bBnHavYZfYeeAF2U1lbLEn2m:khKvJYr/3OW/P44lnHagZfY0F2B2m

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1788 set thread context of 1632	1788	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1632	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe
1632	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1788	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1632	1788	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	27
PID 1788 wrote to memory of 1632	1788	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	27
PID 1788 wrote to memory of 1632	1788	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	27
PID 1788 wrote to memory of 1632	1788	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	27
PID 1788 wrote to memory of 1632	1788	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	27
PID 1788 wrote to memory of 1632	1788	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	27
PID 1788 wrote to memory of 1632	1788	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	27
PID 1788 wrote to memory of 1632	1788	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	27
PID 1632 wrote to memory of 1380	1632	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	15
PID 1632 wrote to memory of 1380	1632	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	15
PID 1632 wrote to memory of 1380	1632	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	15
PID 1632 wrote to memory of 1380	1632	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	15

memory/1380-70-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1632-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1632-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1632-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1632-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1632-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1632-74-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1632-73-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1632-69-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1788-64-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1788-67-0x0000000002041000-0x0000000002045000-memory.dmp

Filesize
16KB

Download
memory/1788-66-0x0000000000260000-0x0000000000299000-memory.dmp

Filesize
228KB

Download
memory/1788-65-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/1788-54-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download