8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266

Analysis

max time kernel
23s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 20:53

Target

8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe
Size

364KB
MD5

6f5cecc68ca87df004cbfdc69a2d7b1f
SHA1

a8a1b7fbc78ea598adb13d7597f93e1837976475
SHA256

8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266
SHA512

df4825eb8530c2faf10fd2ec850361e0d16015f29d01442e5817d3c794c7bb8e100fccd1df0f0058334a97025de2941911ad035e19e9f0f132576cb4359c9f42
SSDEEP

1536:7ILMJ249icel/Z01/NBX4UDpegM3zwACUJGLq42GrElP2T/1oHd5RVJ6wE4ifCKQ:EAX0e1FB/DpKjCLHAE4t1e1vbi

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2004 set thread context of 1888	2004	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2004	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1888	2004	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	28
PID 2004 wrote to memory of 1888	2004	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	28
PID 2004 wrote to memory of 1888	2004	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	28
PID 2004 wrote to memory of 1888	2004	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	28
PID 2004 wrote to memory of 1888	2004	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	28
PID 2004 wrote to memory of 1888	2004	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	28
PID 2004 wrote to memory of 1888	2004	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	28
PID 2004 wrote to memory of 1888	2004	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	28

C:\Users\Admin\AppData\Local\Temp\8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe
"C:\Users\Admin\AppData\Local\Temp\8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe
  "C:\Users\Admin\AppData\Local\Temp\8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe"
  2⤵
  PID:1888

memory/1888-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1888-59-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1888-60-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/1888-61-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download