7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b

Analysis

max time kernel
136s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 10:26

Target

7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b.exe
Size

1.3MB
MD5

0b042e7ad4daef97a77aeb909c122a4f
SHA1

b50ec0aed2ff11d0e1383622d9343dc353152a56
SHA256

7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b
SHA512

de3de83bf05db0a96dde5e2da97476d2ea81e026e23bac47210d634ea0fd6f131fea1cb34b43009bdc293936a0e4916ad53645d24b6baba93c015f7131ea2222
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakm:zrKo4ZwCOnYjVmJPa1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5064 set thread context of 3992	5064	7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3992	5064	7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b.exe	83
PID 5064 wrote to memory of 3992	5064	7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b.exe	83
PID 5064 wrote to memory of 3992	5064	7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b.exe	83
PID 5064 wrote to memory of 3992	5064	7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b.exe	83
PID 5064 wrote to memory of 3992	5064	7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b.exe	83
PID 5064 wrote to memory of 3992	5064	7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b.exe	83
PID 5064 wrote to memory of 3992	5064	7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b.exe	83
PID 5064 wrote to memory of 3992	5064	7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b.exe	83
PID 5064 wrote to memory of 3992	5064	7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b.exe	83
PID 5064 wrote to memory of 3992	5064	7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b.exe	83

C:\Users\Admin\AppData\Local\Temp\7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b.exe
"C:\Users\Admin\AppData\Local\Temp\7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\7b60e8a9806d38162305ed8102068efd77a9e7271113859036c69b976a5d9c2b.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3992

memory/3992-132-0x0000000000000000-mapping.dmp

Download
memory/3992-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3992-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3992-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3992-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3992-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download