ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17

Analysis

max time kernel
4s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 09:27

Target

ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17.exe
Size

247KB
MD5

89a92ed8db97ca243149536d0ff98e2e
SHA1

937658a7c591616c3a93f1fe0ccebdfa9e5fb442
SHA256

ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17
SHA512

656e404ccb8bacdc2e504ca4c126a9902ef51c797681c4a841709d764d67b926232212928def8e812697a66add11c389b39bdbcd0b56fa733f3ce2e0dd00f1fd
SSDEEP

3072:voRDyZT7Ur6MnaiQwudBtNIb5vQcJm11AiBdJOapGCVo41:voRDoY9//vQcJs1A5

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1292 set thread context of 2000	1292	ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
872	2000	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1292	ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2000	1292	ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17.exe	28
PID 1292 wrote to memory of 2000	1292	ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17.exe	28
PID 1292 wrote to memory of 2000	1292	ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17.exe	28
PID 1292 wrote to memory of 2000	1292	ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17.exe	28
PID 1292 wrote to memory of 2000	1292	ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17.exe	28
PID 1292 wrote to memory of 2000	1292	ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17.exe	28
PID 1292 wrote to memory of 2000	1292	ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17.exe	28
PID 1292 wrote to memory of 2000	1292	ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17.exe	28
PID 2000 wrote to memory of 872	2000	ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17.exe	29
PID 2000 wrote to memory of 872	2000	ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17.exe	29
PID 2000 wrote to memory of 872	2000	ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17.exe	29
PID 2000 wrote to memory of 872	2000	ab94d25a8c381c073cde5d5873fbc1146b0ca54ca7963f52f80e34c0490b0f17.exe	29

memory/1292-54-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1292-56-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1292-63-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2000-58-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2000-59-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2000-61-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2000-65-0x0000000000400000-0x0000000000402600-memory.dmp

Filesize
9KB

Download