ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e

Analysis

max time kernel
29s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 13:01

Target

ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe
Size

368KB
MD5

0fb98bb12941c73a11046d00095a151c
SHA1

4239395e5696dba29f327a0d9f5ac7d06ec7d8b7
SHA256

ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e
SHA512

6bc03651fefafb3a7cc8ba7d255057ea96f0bfd2db615243ad405476857faf343fe2733a0a936939f8876a0aa96b03d03ba1dbeb8afc3a9102cdd8a464f276ea
SSDEEP

3072:DgX0e1FB/DpKjCLZbTwjwNl+GPWHYnaNfs3rYDvRNBkB3rNYJ5arv7PdzGi30Bk:DuduHgaN8ONBY3rNM5Gtj3V

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 364 set thread context of 1708	364	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe	26

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1708	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe
1708	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
364	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1708	364	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe	26
PID 364 wrote to memory of 1708	364	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe	26
PID 364 wrote to memory of 1708	364	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe	26
PID 364 wrote to memory of 1708	364	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe	26
PID 364 wrote to memory of 1708	364	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe	26
PID 364 wrote to memory of 1708	364	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe	26
PID 364 wrote to memory of 1708	364	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe	26
PID 364 wrote to memory of 1708	364	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe	26
PID 1708 wrote to memory of 1356	1708	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe	12
PID 1708 wrote to memory of 1356	1708	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe	12
PID 1708 wrote to memory of 1356	1708	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe	12
PID 1708 wrote to memory of 1356	1708	ec2969a9439fdc3f8eabde13367277763330ac21b70602bcd2b064b09d17be1e.exe	12

memory/1356-61-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1708-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1708-59-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1708-60-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1708-64-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download