9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 20:32

Target

9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe
Size

205KB
MD5

81209252524c58378cbefb37da3f8e40
SHA1

6c922e2e8df4658b6682131bde3b28bc7be6c22c
SHA256

9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec
SHA512

f9b0caafbec16bbc0a788ec05dc995421ff17440c64837f50ee426b18c9c51c17444ef7367b314bc20572541e329913d623dc78ac5fda5a796d79ba410a7b706
SSDEEP

3072:6BY06yohsa6XLnxQ5h480DqBRhVh8njm9VCEGKH+YOMp7Ld7Gkcm/:6Qb9SC2DqBRhVh8njm9VCwH+ep7Ld7Gu

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1384 set thread context of 996	1384	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1384	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 996	1384	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	28
PID 1384 wrote to memory of 996	1384	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	28
PID 1384 wrote to memory of 996	1384	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	28
PID 1384 wrote to memory of 996	1384	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	28
PID 1384 wrote to memory of 996	1384	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	28
PID 1384 wrote to memory of 996	1384	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	28
PID 1384 wrote to memory of 996	1384	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	28
PID 1384 wrote to memory of 996	1384	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	28
PID 1384 wrote to memory of 996	1384	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	28
PID 1384 wrote to memory of 996	1384	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	28
PID 1384 wrote to memory of 996	1384	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	28

C:\Users\Admin\AppData\Local\Temp\9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe
"C:\Users\Admin\AppData\Local\Temp\9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Temp\9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe
  C:\Users\Admin\AppData\Local\Temp\9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe
  2⤵
  PID:996

memory/996-57-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/996-58-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/996-59-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/996-60-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/996-63-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/996-65-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1384-54-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download