b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3

Analysis

max time kernel
169s
max time network
183s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:59

Target

b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
Size

64KB
MD5

25b5c130b65a18dfd24fb5e115673309
SHA1

ebd466c5bfbfe172f4c7e002c349f9f51f0949e2
SHA256

b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3
SHA512

c3040c1fc75e27834c36f439667269bf2679e5fdd2cb1ed1735c8f1c0093469f7d210d75be3e2ce8dad48461100f7faea857328e10694dbecfb94686d0b4069a
SSDEEP

1536:E07iT13vfdHldhwTkdZKNu3dJO7tZ9Cb8lHpwo9gLd:1i53vfdHldhwTIKNsTO70YlHBgLd

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe

description	pid	process	target process
PID 1688 set thread context of 296	1688	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe

pid	process
1688	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
1688	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe

pid	process
1688	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
1688	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe

description	pid	process	target process
PID 1688 wrote to memory of 296	1688	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
PID 1688 wrote to memory of 296	1688	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
PID 1688 wrote to memory of 296	1688	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
PID 1688 wrote to memory of 296	1688	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
PID 1688 wrote to memory of 296	1688	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
PID 1688 wrote to memory of 296	1688	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
PID 1688 wrote to memory of 296	1688	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
PID 1688 wrote to memory of 296	1688	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe

C:\Users\Admin\AppData\Local\Temp\b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
C:\Users\Admin\AppData\Local\Temp\b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
2⤵
PID:296

memory/296-55-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/296-56-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/296-57-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/296-58-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/296-59-0x000000000040102E-mapping.dmp

Download
memory/296-62-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1688-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/1688-60-0x0000000000270000-0x0000000000274000-memory.dmp

Filesize
16KB

Download