7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb

Analysis

max time kernel
33s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 03:32

Target

7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe
Size

105KB
MD5

25398ac2c546b951dd60da43141aa6ef
SHA1

eba94012a7150bc9bdc6fc7d4aa45ab415df11d7
SHA256

7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb
SHA512

370a4d04ae4fb4aef4f4b20c3a81a0d55da051934bc41834fb117e6297454a10d225431a649bbda5d03b3407d544842128da6ab8075e10a6cdf460a1beff0f7d
SSDEEP

3072:Vm9HLmcFgMGGiUdQwdIoPslW/N336MdMfLir1vP:Vm9rzFgMGp+dpVqqULirp

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 872 set thread context of 1920	872	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe
1920	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
872	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 1920	872	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe	28
PID 872 wrote to memory of 1920	872	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe	28
PID 872 wrote to memory of 1920	872	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe	28
PID 872 wrote to memory of 1920	872	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe	28
PID 872 wrote to memory of 1920	872	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe	28
PID 872 wrote to memory of 1920	872	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe	28
PID 872 wrote to memory of 1920	872	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe	28
PID 872 wrote to memory of 1920	872	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe	28
PID 1920 wrote to memory of 1244	1920	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe	15
PID 1920 wrote to memory of 1244	1920	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe	15
PID 1920 wrote to memory of 1244	1920	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe	15
PID 1920 wrote to memory of 1244	1920	7f70921cf1b60dd9feb1592be057060d122454bc28a4dc858817beede6f7defb.exe	15

memory/872-59-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1244-62-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1920-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1920-60-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1920-61-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1920-65-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download