90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974

Analysis

max time kernel
132s
max time network
134s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 08:07

Target

90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe
Size

84KB
MD5

397a34f326a91cf75b9d069644150890
SHA1

3a19c3912a079f9ff27ba3294b7e1bfb8dd6aa3f
SHA256

90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974
SHA512

50f1b681c7b512a11d695befbc6e1013d94302369dc089c27d439d8ed0e5dc2e29b6160935ed06eec549addff3afacff61c51c334d8a4070e0582b951fa16dfa
SSDEEP

1536:tqo+k3P1qkSshE60x01kkTrb1J9X1KytiH3c3aJMFJfIE+OIRxE:F+k/1qIhE60x2kQjyXcKaFxIENx

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1084 set thread context of 1676	1084	90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1084	90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe
1084	90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1676	1084	90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe	27
PID 1084 wrote to memory of 1676	1084	90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe	27
PID 1084 wrote to memory of 1676	1084	90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe	27
PID 1084 wrote to memory of 1676	1084	90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe	27
PID 1084 wrote to memory of 1676	1084	90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe	27
PID 1084 wrote to memory of 1676	1084	90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe	27
PID 1084 wrote to memory of 1676	1084	90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe	27
PID 1084 wrote to memory of 1676	1084	90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe	27
PID 1084 wrote to memory of 1676	1084	90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe	27

C:\Users\Admin\AppData\Local\Temp\90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe
"C:\Users\Admin\AppData\Local\Temp\90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Local\Temp\90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe
  C:\Users\Admin\AppData\Local\Temp\90faee535ad92d06c963cb136c05c0ee47522826df4db0467f4a91db5be5c974.exe
  2⤵
  PID:1676

memory/1084-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1084-62-0x0000000000260000-0x0000000000264000-memory.dmp

Filesize
16KB

Download
memory/1676-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1676-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1676-58-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1676-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1676-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1676-65-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download