4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83

Analysis

max time kernel
158s
max time network
188s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 03:13

Target

4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe
Size

1.2MB
MD5

c64ea5937774ace6de198b245896d2c2
SHA1

af0a99e43617739785d218a752af632bad684eb7
SHA256

4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83
SHA512

84754c2aece423f2e2b7341831421eda425702d6aabddc32c110182ff765f669d7c14310de63b6f7f118717574d48ed68071a01b7574bb538a70b9c1b3599513
SSDEEP

24576:7NNY5NNkYBgQtbqGDo4s/n8CeSovyre6qFPNocSY:7NNyNNkYBntrDds/byKreZ1KcSY

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1816 set thread context of 1996	1816	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1996	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1816	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1996	1816	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	28
PID 1816 wrote to memory of 1996	1816	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	28
PID 1816 wrote to memory of 1996	1816	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	28
PID 1816 wrote to memory of 1996	1816	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	28
PID 1816 wrote to memory of 1996	1816	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	28
PID 1816 wrote to memory of 1996	1816	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	28
PID 1816 wrote to memory of 1996	1816	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	28
PID 1816 wrote to memory of 1996	1816	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	28
PID 1816 wrote to memory of 1996	1816	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	28
PID 1816 wrote to memory of 1996	1816	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	28

C:\Users\Admin\AppData\Local\Temp\4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe
"C:\Users\Admin\AppData\Local\Temp\4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe
  "C:\Users\Admin\AppData\Local\Temp\4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996

memory/1996-56-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1996-59-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1996-60-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download
memory/1996-61-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download