ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 02:00

Target

ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe
Size

240KB
MD5

b9d564eb2bd9699c04fc0239bbb3b814
SHA1

9cfc9f538f747536158da96148ba8deec9fc4064
SHA256

ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031
SHA512

93b564486b640d21ff2955fd0431f4f86991d61c8e901681933221deb2104f22faf596675bca2297ecab108af864be5dcfcca8c2f9d61b0f8d573a7b0fe5842a
SSDEEP

6144:LWOipIA/VeF4qliVO1P5AiTNuKdJhNFEzX:LfipIA/Ve2qYIbTED

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1716 set thread context of 1972	1716	ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1716	ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1972	1716	ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe	28
PID 1716 wrote to memory of 1972	1716	ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe	28
PID 1716 wrote to memory of 1972	1716	ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe	28
PID 1716 wrote to memory of 1972	1716	ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe	28
PID 1716 wrote to memory of 1972	1716	ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe	28
PID 1716 wrote to memory of 1972	1716	ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe	28
PID 1716 wrote to memory of 1972	1716	ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe	28
PID 1716 wrote to memory of 1972	1716	ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe	28
PID 1716 wrote to memory of 1972	1716	ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe	28

C:\Users\Admin\AppData\Local\Temp\ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe
"C:\Users\Admin\AppData\Local\Temp\ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Users\Admin\AppData\Local\Temp\ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe
  "C:\Users\Admin\AppData\Local\Temp\ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe"
  2⤵
  PID:1972

memory/1716-56-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download
memory/1972-57-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1972-58-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1972-60-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1972-61-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1972-63-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1972-67-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download