c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f

Analysis

max time kernel
259s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 03:41

Target

c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f.exe
Size

39KB
MD5

94473da20ec16d45f7868e1837d0af75
SHA1

096cff83fcca5ee14f06117b7c8aff2fa6b54c02
SHA256

c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f
SHA512

fada5c3b25189c6595a970bd48f702352f195fe375175ca614e22e715717e28e97cdd0383f151747a18f63e63f9514ef524371f4ce68425036d0d22dec2ee08e
SSDEEP

768:SAYwPFLQNZJYhRX9xstJyeAdaECt7MVx9nNzpb6NL:PLQNZUPCL

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 756 set thread context of 1468	756	c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
756	c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1468	756	c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f.exe	28
PID 756 wrote to memory of 1468	756	c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f.exe	28
PID 756 wrote to memory of 1468	756	c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f.exe	28
PID 756 wrote to memory of 1468	756	c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f.exe	28
PID 756 wrote to memory of 1468	756	c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f.exe	28
PID 756 wrote to memory of 1468	756	c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f.exe	28
PID 756 wrote to memory of 1468	756	c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f.exe	28
PID 756 wrote to memory of 1468	756	c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f.exe	28

C:\Users\Admin\AppData\Local\Temp\c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f.exe
"C:\Users\Admin\AppData\Local\Temp\c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Local\Temp\c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f.exe
  C:\Users\Admin\AppData\Local\Temp\c5307315406a925b563fb9ce48ebd5bea1950d94685eb69de4de69b21983ec5f.exe
  2⤵
  PID:1468

memory/1468-56-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/1468-58-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1468-60-0x0000000000400200-0x0000000000400400-memory.dmp

Filesize
512B

Download
memory/1468-61-0x0000000000400208-mapping.dmp

Download
memory/1468-62-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download