7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 10:26

Target

7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe
Size

1.3MB
MD5

2f963df6d27c28e99fad0d7ca28ac877
SHA1

daac8c88a65c915624ec40000c8c2e505f7bc6b3
SHA256

7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2
SHA512

6065feabe940cc170d3c63b2fb09ec4897f914761825eef79ed601f0bed41f506777962b22597938e5fd33dbe8b04e6c3197537643387fa7a427b399e2fd5d01
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:zrKo4ZwCOnYjVmJPa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4200 set thread context of 4916	4200	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4916	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe
4916	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe
4916	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe
4916	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe
4916	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 4916	4200	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe	81
PID 4200 wrote to memory of 4916	4200	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe	81
PID 4200 wrote to memory of 4916	4200	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe	81
PID 4200 wrote to memory of 4916	4200	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe	81
PID 4200 wrote to memory of 4916	4200	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe	81
PID 4200 wrote to memory of 4916	4200	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe	81
PID 4200 wrote to memory of 4916	4200	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe	81
PID 4200 wrote to memory of 4916	4200	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe	81
PID 4200 wrote to memory of 4916	4200	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe	81
PID 4200 wrote to memory of 4916	4200	7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe	81

C:\Users\Admin\AppData\Local\Temp\7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe
"C:\Users\Admin\AppData\Local\Temp\7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Users\Admin\AppData\Local\Temp\7b56a66e9eb6f1f7ffe452e94570021214cfd40553d343a62c319aff0bce15e2.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4916

memory/4916-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4916-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4916-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4916-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4916-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download