872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 08:15

Target

872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe
Size

224KB
MD5

0973e1cd36ff010b107085f105b35d70
SHA1

25dc8c9b5e60e5e135a685eb9d4fb188dbf984e0
SHA256

872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206
SHA512

25f9c14f757d751b924316b551b181b0f8e5194a20c93c5ba4cb6a380d9c4f48af163314380f51923b710ec5c3cb9e16eaa730012ba3c8d62e51251bb4a4844e
SSDEEP

6144:tKnrniKx4nFc8bh1QBqhOU09cITc4E4u3j:tKnriKxsFc8d1zhOU6lTc4ruz

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 364 set thread context of 1536	364	872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe	27

Suspicious use of AdjustPrivilegeToken 5 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
364	872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1536	364	872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe	27
PID 364 wrote to memory of 1536	364	872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe	27
PID 364 wrote to memory of 1536	364	872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe	27
PID 364 wrote to memory of 1536	364	872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe	27
PID 364 wrote to memory of 1536	364	872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe	27
PID 364 wrote to memory of 1536	364	872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe	27
PID 364 wrote to memory of 1536	364	872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe	27
PID 364 wrote to memory of 1536	364	872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe	27
PID 364 wrote to memory of 1536	364	872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe	27

C:\Users\Admin\AppData\Local\Temp\872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe
"C:\Users\Admin\AppData\Local\Temp\872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Local\Temp\872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe
  "C:\Users\Admin\AppData\Local\Temp\872bc7c3d7310735d5a6e53524b1a8a05f280ae9040deeb025857a687b94b206.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1536

memory/1536-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1536-59-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/1536-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download