28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 02:02

Target

28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe
Size

193KB
MD5

3b6c5862f2a4660c94415b5898c0fb46
SHA1

5a0c972dad7a6f736f6a8350d18dea105667eadb
SHA256

28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072
SHA512

700ac8fa0ef6cab813b1836e000de1aec13be7db82a3fa7eac9a8b5de5b0e619e6bd34962a81e0ffc1bcfae155e28d0181a9ddfa50dc92fa3d6937e3ee6aed42
SSDEEP

3072:6P5PDykjCBx2hypK7D6zdX3+P+kdMTg5nGA42wI5niY:6x5GXI5V

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 784 set thread context of 1428	784	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe	26

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1428	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe
1428	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
784	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1428	784	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe	26
PID 784 wrote to memory of 1428	784	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe	26
PID 784 wrote to memory of 1428	784	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe	26
PID 784 wrote to memory of 1428	784	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe	26
PID 784 wrote to memory of 1428	784	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe	26
PID 784 wrote to memory of 1428	784	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe	26
PID 784 wrote to memory of 1428	784	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe	26
PID 784 wrote to memory of 1428	784	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe	26
PID 1428 wrote to memory of 1360	1428	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe	12
PID 1428 wrote to memory of 1360	1428	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe	12
PID 1428 wrote to memory of 1360	1428	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe	12
PID 1428 wrote to memory of 1360	1428	28e282d218f91558490c8c124322ff093297923eb8ad3b467833aa4544c04072.exe	12

memory/784-54-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/784-60-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1360-63-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1428-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1428-61-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1428-62-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/1428-66-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download