4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 18:03

Target

4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe
Size

179KB
MD5

51611fb966280a0121960aa0194c51b0
SHA1

ed8b56cb88148fed2f6955638d960d6ae25bbefc
SHA256

4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678
SHA512

c03824be2d5bf06e249e485524ffd72501650d564c0b917bd5d44b8fa897142ba497c3a4f04702a938947bed2b1096d807a2df3f8b53c827bbccd5d98796e79b
SSDEEP

3072:Dn0n3ObOj7OZx3og1NtzEHDMiPyjp6o/bhE4ohLmHp0Mcp+o:Dn03OkaZxfNt4jMik5mFL+o1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 288 set thread context of 1788	288	4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
288	4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 1788	288	4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe	28
PID 288 wrote to memory of 1788	288	4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe	28
PID 288 wrote to memory of 1788	288	4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe	28
PID 288 wrote to memory of 1788	288	4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe	28
PID 288 wrote to memory of 1788	288	4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe	28
PID 288 wrote to memory of 1788	288	4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe	28
PID 288 wrote to memory of 1788	288	4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe	28
PID 288 wrote to memory of 1788	288	4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe	28
PID 288 wrote to memory of 1788	288	4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe	28

C:\Users\Admin\AppData\Local\Temp\4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe
"C:\Users\Admin\AppData\Local\Temp\4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288
- C:\Users\Admin\AppData\Local\Temp\4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe
  "C:\Users\Admin\AppData\Local\Temp\4bb4235f96a28ffb65231d1edc1510c548e3fae5cf2f9e5a64f2696b46b63678.exe"
  2⤵
  PID:1788

memory/1788-56-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1788-57-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1788-59-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1788-60-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1788-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1788-65-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1788-66-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download