b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 08:26

Target

b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358.exe
Size

732KB
MD5

2bcd984f0b2ad831d7886acf91970aa5
SHA1

22bbd31592618588066141eef2fd79f21aed9a88
SHA256

b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358
SHA512

ead0183cfbf7c1ed426697129d6e17456f68521170db57071281f960f0f37f8b3b6c06cf3111093c28953e93704527edf68a99971e2c944bb9f22a9445b4d4e6
SSDEEP

3072:zfimYWNMbfAno1WpQMc9VQrkfooDy/ljeS5F3qZK4P1Jts4DcMzoyDSPOZ9uF0K5:++jbEShkbrYk

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 1104	1932	b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1932	b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1104	1932	b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358.exe	27
PID 1932 wrote to memory of 1104	1932	b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358.exe	27
PID 1932 wrote to memory of 1104	1932	b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358.exe	27
PID 1932 wrote to memory of 1104	1932	b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358.exe	27
PID 1932 wrote to memory of 1104	1932	b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358.exe	27
PID 1932 wrote to memory of 1104	1932	b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358.exe	27
PID 1932 wrote to memory of 1104	1932	b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358.exe	27
PID 1932 wrote to memory of 1104	1932	b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358.exe	27

C:\Users\Admin\AppData\Local\Temp\b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358.exe
"C:\Users\Admin\AppData\Local\Temp\b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358.exe
  C:\Users\Admin\AppData\Local\Temp\b39a3c70f1e154df05639a717b694ce08c088d0f54f2097aad09e5c5c25ff358.exe
  2⤵
  PID:1104

memory/1104-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1104-57-0x0000000000407C89-mapping.dmp

Download
memory/1104-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1104-60-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/1104-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1104-62-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download