33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 20:32

Target

33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6.exe
Size

77KB
MD5

f4513162a83a4212c5e60adc8a8bd289
SHA1

a99d57e1e8462ee4e1e3a97abb3c130d3365f85b
SHA256

33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6
SHA512

41b5a4237b0c1bdfe0de65566ff135797a26b4dd2e01799650caa660361e55b2938bc5a24863b8b8c26266e39df25c1fc4ac061c620694ea0d1bf7ca0a840fa8
SSDEEP

1536:oCi/LdLPc9yR7LMsLXQieqkrXrdGUltXXW:oN/Li9y1PLQPJXrdDHXXW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 908 set thread context of 1296	908	33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
908	33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1296	908	33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6.exe	27
PID 908 wrote to memory of 1296	908	33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6.exe	27
PID 908 wrote to memory of 1296	908	33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6.exe	27
PID 908 wrote to memory of 1296	908	33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6.exe	27
PID 908 wrote to memory of 1296	908	33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6.exe	27
PID 908 wrote to memory of 1296	908	33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6.exe	27
PID 908 wrote to memory of 1296	908	33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6.exe	27
PID 908 wrote to memory of 1296	908	33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6.exe	27

C:\Users\Admin\AppData\Local\Temp\33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6.exe
"C:\Users\Admin\AppData\Local\Temp\33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6.exe
  "C:\Users\Admin\AppData\Local\Temp\33742d0ca4ac2fb51047f24f7344b32a57d3360b787adeb97530fd85343979b6.exe"
  2⤵
  PID:1296

memory/1296-56-0x0000000000400200-0x0000000000400400-memory.dmp

Filesize
512B

Download
memory/1296-58-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download