eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1

Analysis

max time kernel
186s
max time network
242s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 10:40

Target

eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe
Size

123KB
MD5

7dbbe0d2150a671d7f65b4c387d68773
SHA1

5329662abbeef51f47e9283c704a9dae1e0fcb61
SHA256

eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1
SHA512

e20d6eab7ecc36cbfc42d1c86caf533b2bdca649f453fc85f7773cae33d4aa6a53c266261a584ae7889084bf0623898bb058fb6bda483e3d56a17870a12e1c3f
SSDEEP

3072:XLF9CWADbxOhoFQ8G6felNwb4mj32OVuGEU8iW+:7F9CR1OhoC83b2kuBqD

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1100 set thread context of 940	1100	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1100	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1100	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe
1100	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 940	1100	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	27
PID 1100 wrote to memory of 940	1100	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	27
PID 1100 wrote to memory of 940	1100	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	27
PID 1100 wrote to memory of 940	1100	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	27
PID 1100 wrote to memory of 940	1100	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	27
PID 1100 wrote to memory of 940	1100	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	27
PID 1100 wrote to memory of 940	1100	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	27
PID 1100 wrote to memory of 940	1100	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	27
PID 1100 wrote to memory of 940	1100	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	27
PID 1100 wrote to memory of 940	1100	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	27

C:\Users\Admin\AppData\Local\Temp\eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe
"C:\Users\Admin\AppData\Local\Temp\eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe
  C:\Users\Admin\AppData\Local\Temp\eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe
  2⤵
  PID:940

memory/940-65-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/940-67-0x0000000000400000-0x0000000005DD8000-memory.dmp

Filesize
89.8MB

Download
memory/940-57-0x0000000000400000-0x0000000005DD8000-memory.dmp

Filesize
89.8MB

Download
memory/940-74-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/940-59-0x0000000000400000-0x0000000005DD8000-memory.dmp

Filesize
89.8MB

Download
memory/940-61-0x0000000000400000-0x0000000005DD8000-memory.dmp

Filesize
89.8MB

Download
memory/940-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/940-63-0x0000000000400000-0x0000000005DD8000-memory.dmp

Filesize
89.8MB

Download
memory/940-62-0x0000000000400000-0x0000000005DD8000-memory.dmp

Filesize
89.8MB

Download
memory/940-71-0x0000000000020000-0x0000000000027000-memory.dmp

Filesize
28KB

Download
memory/940-68-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/940-69-0x0000000000400000-0x0000000005DD8000-memory.dmp

Filesize
89.8MB

Download
memory/1100-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1100-58-0x0000000000260000-0x0000000000264000-memory.dmp

Filesize
16KB

Download