ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab

Analysis

max time kernel
43s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 15:52

Target

ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe
Size

164KB
MD5

3e34d7146cecd2d54c2ba47cb8c97f64
SHA1

c310cd7c0e511c4a9a3de99feed725230d5fc48b
SHA256

ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab
SHA512

1f13e57ad70d32a575c15742af353326cd343ef4890686a5e25b77f282fca66f8edd9b765757bffe34d36caeaf2d66d8e36c372b3aa21b3fc39d2720e21af6f9
SSDEEP

1536:Y29t/F0M9x58frp//dd76SZFXC+VIUVfxu8xaSOIlJzERa6gIOtiZEO2EJ1U64rw:HX/rqzp/VR/5Jw8Oq+1ZAwALvulotmiy

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1048 set thread context of 948	1048	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
948	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe
948	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1048	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 948	1048	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe	27
PID 1048 wrote to memory of 948	1048	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe	27
PID 1048 wrote to memory of 948	1048	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe	27
PID 1048 wrote to memory of 948	1048	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe	27
PID 1048 wrote to memory of 948	1048	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe	27
PID 1048 wrote to memory of 948	1048	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe	27
PID 1048 wrote to memory of 948	1048	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe	27
PID 1048 wrote to memory of 948	1048	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe	27
PID 948 wrote to memory of 1400	948	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe	15
PID 948 wrote to memory of 1400	948	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe	15
PID 948 wrote to memory of 1400	948	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe	15
PID 948 wrote to memory of 1400	948	ffbd10f88b5abe8e3dd02724873be32b900039439a85f30584fc82e940ed1dab.exe	15

memory/948-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/948-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/948-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/948-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/948-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/948-64-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/948-68-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/948-69-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1400-65-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download