98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db

Analysis

max time kernel
148s
max time network
161s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 08:02

Target

98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe
Size

123KB
MD5

1352f9d51aaf45d0065b4604da7ccec0
SHA1

749d77f5580b91414f7daa6397c13ef522b8f97d
SHA256

98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db
SHA512

88f7f91b637cd5f2a7c193ae84e7ebad964d22c42048f1602a4842f312fd928b504c7554d05040e7d4ce120ab47aabc5c0c08d668c66f09c9e68a6eac2e58c31
SSDEEP

3072:j9qA59Rx2Q6QH4ke9UZRuwYA8CyDqhRbU:j9bRld70LAhyDylU

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1492 set thread context of 960	1492	98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1492	98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 960	1492	98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe	28
PID 1492 wrote to memory of 960	1492	98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe	28
PID 1492 wrote to memory of 960	1492	98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe	28
PID 1492 wrote to memory of 960	1492	98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe	28
PID 1492 wrote to memory of 960	1492	98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe	28
PID 1492 wrote to memory of 960	1492	98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe	28
PID 1492 wrote to memory of 960	1492	98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe	28
PID 1492 wrote to memory of 960	1492	98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe	28
PID 1492 wrote to memory of 960	1492	98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe	28

C:\Users\Admin\AppData\Local\Temp\98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe
"C:\Users\Admin\AppData\Local\Temp\98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe
  C:\Users\Admin\AppData\Local\Temp\98cdb66a130a8dd221b2a9258d8161e2978dbde91a144b9fa92e7bf0df3415db.exe
  2⤵
  PID:960

memory/960-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/960-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/960-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/960-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/960-58-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/960-65-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1492-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1492-63-0x0000000000430000-0x0000000000434000-memory.dmp

Filesize
16KB

Download