bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931

Analysis

max time kernel
41s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 05:26

Target

bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe
Size

79KB
MD5

7329f6c88e767e5b43be2ae854a5f339
SHA1

f6a4726195c6b1127f2b95a1afc6b9ddd8cc4113
SHA256

bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931
SHA512

6653dc9f6af62e91c06eec58d8a61463ca3651beb42e934d7a3ced8bded5bf255a7b209393d866236f195ffbb1a549318a842a67bea9770a0f2a0470a1416dee
SSDEEP

1536:nSB/L0x5iUwb0dRTYwGJY81ErYeMEZsGkfDlz:SVL0x5BwATYwKY81sTME0t

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1592 set thread context of 1208	1592	bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1592	bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe
1208	bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 1208	1592	bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe	28
PID 1592 wrote to memory of 1208	1592	bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe	28
PID 1592 wrote to memory of 1208	1592	bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe	28
PID 1592 wrote to memory of 1208	1592	bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe	28
PID 1592 wrote to memory of 1208	1592	bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe	28
PID 1592 wrote to memory of 1208	1592	bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe	28
PID 1592 wrote to memory of 1208	1592	bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe	28
PID 1592 wrote to memory of 1208	1592	bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe	28

C:\Users\Admin\AppData\Local\Temp\bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe
"C:\Users\Admin\AppData\Local\Temp\bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Users\Admin\AppData\Local\Temp\bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe
  C:\Users\Admin\AppData\Local\Temp\bd1ebaefdd5ac84d0760a56a0c1686e4afc53e01ecb05565a9e8ad5c05eaf931.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1208

memory/1208-56-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1208-57-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1208-58-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1208-59-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1208-64-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1208-65-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download