b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8

Analysis

max time kernel
234s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 14:49

Target

b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe
Size

205KB
MD5

768beadb642c662bd2a49d79243ab46f
SHA1

409b350ca3dd9b2a9233fd57b29341e1a26c9bae
SHA256

b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8
SHA512

23b2214ba9fc6f2aa1297d8feb6abaab4f2ca2e89c9943b7e082d8917b5a8fd40f3f8e533d552ea75ddd88ee87e375706c073caea8ac16ba72eb55172615f433
SSDEEP

3072:GB406yohsa6XLnxQ5h480DqBRhVh8njm9VCEGKH+YOMp7Ld7Gkcm/:GAb9SC2DqBRhVh8njm9VCwH+ep7Ld7Gu

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 692 set thread context of 1116	692	b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
692	b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 1116	692	b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe	28
PID 692 wrote to memory of 1116	692	b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe	28
PID 692 wrote to memory of 1116	692	b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe	28
PID 692 wrote to memory of 1116	692	b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe	28
PID 692 wrote to memory of 1116	692	b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe	28
PID 692 wrote to memory of 1116	692	b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe	28
PID 692 wrote to memory of 1116	692	b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe	28
PID 692 wrote to memory of 1116	692	b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe	28
PID 692 wrote to memory of 1116	692	b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe	28
PID 692 wrote to memory of 1116	692	b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe	28
PID 692 wrote to memory of 1116	692	b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe	28

C:\Users\Admin\AppData\Local\Temp\b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe
"C:\Users\Admin\AppData\Local\Temp\b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692
- C:\Users\Admin\AppData\Local\Temp\b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe
  C:\Users\Admin\AppData\Local\Temp\b52db5893bec3efcaffaf140b55e893d0131843512ebb438a48c1050a4893dd8.exe
  2⤵
  PID:1116

memory/692-54-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download
memory/1116-57-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1116-58-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1116-59-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1116-60-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1116-61-0x0000000000401038-mapping.dmp

Download
memory/1116-63-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1116-65-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download