b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e

Analysis

max time kernel
329s
max time network
351s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 18:56

Target

b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e.exe
Size

229KB
MD5

54d53cc7097f3d338b779f38b2e72e90
SHA1

668039fdb3f1b0ce4bd00bd4fb228375c140299a
SHA256

b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e
SHA512

a7c12130c5d0f5dc399d4f81d05f1d81690f9a429d8f4aeeca9e199b8be24c18c3e156a93181c000d3cf212872012cb7ca0187277d693643ccd5b8d1526f6608
SSDEEP

3072:cduZPYFASjJyJTlMdqWP077ufSHS3KB5S/TYMe3sZLubeVyAPPTIQNnYLj:vYFnAxUqP/ufmS3KvF3sZLN+Lj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3168 set thread context of 4396	3168	b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3168	b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 4396	3168	b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e.exe	82
PID 3168 wrote to memory of 4396	3168	b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e.exe	82
PID 3168 wrote to memory of 4396	3168	b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e.exe	82
PID 3168 wrote to memory of 4396	3168	b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e.exe	82
PID 3168 wrote to memory of 4396	3168	b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e.exe	82
PID 3168 wrote to memory of 4396	3168	b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e.exe	82
PID 3168 wrote to memory of 4396	3168	b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e.exe	82
PID 3168 wrote to memory of 4396	3168	b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e.exe	82

C:\Users\Admin\AppData\Local\Temp\b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e.exe
"C:\Users\Admin\AppData\Local\Temp\b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Users\Admin\AppData\Local\Temp\b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e.exe
  "C:\Users\Admin\AppData\Local\Temp\b7cbdb4312a8c021b0a438eab405e995e2fad045ce7d91aa317d1701d5b6502e.exe"
  2⤵
  PID:4396

memory/4396-134-0x0000000000000000-mapping.dmp

Download
memory/4396-135-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4396-137-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download