86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780

Analysis

max time kernel
24s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 17:32

Target

86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe
Size

181KB
MD5

e00cbc650df1f619fa7f4eafafd6f834
SHA1

c3063a6b475e1a7438ed35b3c5263bb27b75ed01
SHA256

86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780
SHA512

8104f2d9b883bd2946ae098515b99de9299e8fecb5b4b1438142bc4fbf17f2b7a3945230e0d2c44d732144e180ed93e64d58e84a915a688892e519829b12c1e4
SSDEEP

3072:5RBUFBNGJZuY4ttUIh8YasiYHqYJGBWzcJvHJ1S/JmmO:5nuUZF4tSI+YdzjJGBC4vnSxm7

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1236 set thread context of 1108	1236	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	28

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1108	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe
1108	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1236	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1108	1236	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	28
PID 1236 wrote to memory of 1108	1236	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	28
PID 1236 wrote to memory of 1108	1236	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	28
PID 1236 wrote to memory of 1108	1236	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	28
PID 1236 wrote to memory of 1108	1236	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	28
PID 1236 wrote to memory of 1108	1236	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	28
PID 1236 wrote to memory of 1108	1236	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	28
PID 1236 wrote to memory of 1108	1236	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	28
PID 1108 wrote to memory of 1196	1108	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	11
PID 1108 wrote to memory of 1196	1108	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	11
PID 1108 wrote to memory of 1196	1108	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	11
PID 1108 wrote to memory of 1196	1108	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	11

memory/1108-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1108-57-0x0000000000407A4D-mapping.dmp

Download
memory/1108-60-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1108-61-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/1108-65-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1196-62-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1236-59-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download