d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849

Analysis

max time kernel
17s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 17:07

Target

d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe
Size

222KB
MD5

8c2c63c75c29498c55d3227b9d0d8d03
SHA1

df167d1f58add625e9dd2affe95f4f16507485d1
SHA256

d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849
SHA512

c09a3d7594b52a6396e79828f36a6134dfbec78a919217dfe48fe5c9dbf26c40da88ad3b6d79830df6883c2cd45b0d679bf4c29566143a041199b002297b82b3
SSDEEP

6144:6YrW2OZNQh+TNfCa3YrrApqQLiYoquc769/coIAO:ZiTZGopfCa3YrMpqNTc769koIAO

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 892 set thread context of 852	892	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe	27

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
852	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe
852	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
892	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 852	892	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe	27
PID 892 wrote to memory of 852	892	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe	27
PID 892 wrote to memory of 852	892	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe	27
PID 892 wrote to memory of 852	892	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe	27
PID 892 wrote to memory of 852	892	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe	27
PID 892 wrote to memory of 852	892	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe	27
PID 892 wrote to memory of 852	892	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe	27
PID 892 wrote to memory of 852	892	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe	27
PID 852 wrote to memory of 1264	852	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe	7
PID 852 wrote to memory of 1264	852	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe	7
PID 852 wrote to memory of 1264	852	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe	7
PID 852 wrote to memory of 1264	852	d244fd1415f92bda34bc155d1fca9d38b9f1854710cabe676d274593efcf8849.exe	7

memory/852-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/852-61-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/852-62-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/852-66-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/892-54-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/892-60-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1264-63-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download