fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 21:39

Target

fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe
Size

89KB
MD5

01f5da21a08dbfbf08ca2c701a78f2c0
SHA1

8043899e946af7d84466578dd08214482c2e9223
SHA256

fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe
SHA512

faf2469306f819627a8381739a404a2b3029972446a3faf8731cd366a0f3921d230b42cb8e41d454e603e8b334d7e9a147e40ee3243e4bf318599de077f1363d
SSDEEP

1536:xE5cszXNPY6w2c2eQEPcjAVOvVFAnE2wCsc4fs0KiZriNdaLQ8gCj5:e5xbNPYaJjAV+FmE2wH907ilRgCN

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 768 set thread context of 856	768	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
856	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe
856	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe
856	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe
856	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
768	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 856	768	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe	28
PID 768 wrote to memory of 856	768	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe	28
PID 768 wrote to memory of 856	768	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe	28
PID 768 wrote to memory of 856	768	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe	28
PID 768 wrote to memory of 856	768	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe	28
PID 768 wrote to memory of 856	768	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe	28
PID 768 wrote to memory of 856	768	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe	28
PID 768 wrote to memory of 856	768	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe	28
PID 768 wrote to memory of 856	768	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe	28
PID 768 wrote to memory of 856	768	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe	28
PID 768 wrote to memory of 856	768	fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe	28

C:\Users\Admin\AppData\Local\Temp\fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe
"C:\Users\Admin\AppData\Local\Temp\fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768
- C:\Users\Admin\AppData\Local\Temp\fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe
  "C:\Users\Admin\AppData\Local\Temp\fd908b060173c392b6974a259d025e1c0a33440859b4de5ff294355d7dd2eabe.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:856

memory/856-56-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/856-57-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/856-59-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/856-61-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/856-63-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/856-64-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/856-66-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/856-69-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/856-70-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/856-71-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download