a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac

Analysis

max time kernel
4s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 21:07

Target

a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe
Size

184KB
MD5

dbfdb4c92c8f5b6875963d36da4dec76
SHA1

da281aac95b3e7845269f80f2a39c2f21d781621
SHA256

a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac
SHA512

edde62f577bbf10f4f2d3bff89815e24551225369a86f0781c34be1b254bbd9e7a8b4a3b91512b91e110c361382504ac86ef3b9471a2b11359d3a0d18f922d3e
SSDEEP

3072:FIoiR3mDI1PMQmYjN+3+W799C4Uu9CGEeXwBUcRdLwKWV4W6ghe:FIom1PMQmYjN+3+WnK1RdLuV4jr

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2044 set thread context of 520	2044	a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2044	a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 520	2044	a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe	28
PID 2044 wrote to memory of 520	2044	a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe	28
PID 2044 wrote to memory of 520	2044	a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe	28
PID 2044 wrote to memory of 520	2044	a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe	28
PID 2044 wrote to memory of 520	2044	a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe	28
PID 2044 wrote to memory of 520	2044	a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe	28
PID 2044 wrote to memory of 520	2044	a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe	28
PID 2044 wrote to memory of 520	2044	a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe	28
PID 2044 wrote to memory of 520	2044	a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe	28

C:\Users\Admin\AppData\Local\Temp\a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe
"C:\Users\Admin\AppData\Local\Temp\a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe
  C:\Users\Admin\AppData\Local\Temp\a1aa06a3931ffe2aa143ea63bc243779f30f96a4601f84ee329f169dc78184ac.exe
  2⤵
  PID:520

memory/520-56-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download