9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff

Analysis

max time kernel
42s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 08:36

Target

9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe
Size

70KB
MD5

bf9134c1b611f58d180b763769e86cf4
SHA1

0e097a9b6d7710ad490f68c40684986df2b850f2
SHA256

9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff
SHA512

164a287ab6f296767a1cebcbc88ffea75b20e5d5875452845e329699c80141e9d983e5b65162141674ff9f244f07468ff5b2e5053eaddac3280fcdf2c45ae1c1
SSDEEP

1536:HqiN2G50ffaX+Hv99DJYL2TvQJBAUFkDegvNeFjm0AJMR:Kk350XbHFzjTvScegvqjS+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 944 set thread context of 888	944	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
944	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe
888	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 888	944	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	28
PID 944 wrote to memory of 888	944	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	28
PID 944 wrote to memory of 888	944	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	28
PID 944 wrote to memory of 888	944	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	28
PID 944 wrote to memory of 888	944	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	28
PID 944 wrote to memory of 888	944	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	28
PID 944 wrote to memory of 888	944	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	28
PID 944 wrote to memory of 888	944	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	28
PID 944 wrote to memory of 888	944	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	28

C:\Users\Admin\AppData\Local\Temp\9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe
"C:\Users\Admin\AppData\Local\Temp\9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944
- C:\Users\Admin\AppData\Local\Temp\9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe
  C:\Users\Admin\AppData\Local\Temp\9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:888

memory/888-67-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/888-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/888-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/888-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/888-68-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/888-65-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/888-69-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/888-58-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/888-57-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/888-66-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/888-70-0x0000000000290000-0x00000000002A0000-memory.dmp

Filesize
64KB

Download
memory/888-71-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download
memory/888-72-0x00000000002B0000-0x00000000002C0000-memory.dmp

Filesize
64KB

Download
memory/888-74-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/944-73-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/944-56-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download