e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893

Analysis

max time kernel
38s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 23:28

Target

e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe
Size

216KB
MD5

064ef0bf63029d099ed0ab83c32131f8
SHA1

313bf1a7b754c56a5c3081c8759e3ca76628c2f8
SHA256

e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893
SHA512

d4077e8d8ecfa47ece3ed42dfb6d1c5b1e5588cacd32d8800c27f5029d3463ddea367e89e2dc0d9b31638a3b00c89caf567e4ae6b6ac41f79647261ec37adf74
SSDEEP

3072:bYWlCjnQllFKtQohSuGtsDeZU59oB0Q6FQUH3YMZrCbVNXkAnEDXfkzzaPB:bWQllF6QohSgq2Eu1HilBnoMzzKB

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 892 set thread context of 1504	892	e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
892	e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1504	892	e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe	28
PID 892 wrote to memory of 1504	892	e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe	28
PID 892 wrote to memory of 1504	892	e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe	28
PID 892 wrote to memory of 1504	892	e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe	28
PID 892 wrote to memory of 1504	892	e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe	28
PID 892 wrote to memory of 1504	892	e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe	28
PID 892 wrote to memory of 1504	892	e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe	28
PID 892 wrote to memory of 1504	892	e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe	28
PID 892 wrote to memory of 1504	892	e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe	28

C:\Users\Admin\AppData\Local\Temp\e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe
"C:\Users\Admin\AppData\Local\Temp\e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892
- C:\Users\Admin\AppData\Local\Temp\e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe
  C:\Users\Admin\AppData\Local\Temp\e73b12bd51821036300d44b871b0ec1517649f3b5f7ad6ebfaf3015b81258893.exe
  2⤵
  PID:1504

memory/1504-56-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1504-59-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1504-60-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download