fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70

Analysis

max time kernel
42s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 10:34

Target

fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe
Size

277KB
MD5

b1b984e85b4667d31b07a4a0fbef6615
SHA1

1a2a7f155fa4d4eaef49c58b8077d2a0ec03f14b
SHA256

fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70
SHA512

383d0ff24eb4cf38b6ed3e1d434b3e9800a8313558b96b387f7ef1483accc67af9c264298c88a19c04449b5843933c68c969b1bf861ba4cc0d3280617fdd92b3
SSDEEP

3072:hAp7lLCT7mstYeQSkPYxz29Gdk6Stx/KqiOvDCH1M2ZyeqAiLGI2ud+3OFyBUII:hARlLCT52WsGd3eiqvDCC2nJR3OmUx

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1736 set thread context of 1040	1736	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1736	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1040	1736	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	28
PID 1736 wrote to memory of 1040	1736	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	28
PID 1736 wrote to memory of 1040	1736	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	28
PID 1736 wrote to memory of 1040	1736	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	28
PID 1736 wrote to memory of 1040	1736	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	28
PID 1736 wrote to memory of 1040	1736	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	28
PID 1736 wrote to memory of 1040	1736	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	28
PID 1736 wrote to memory of 1040	1736	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	28
PID 1736 wrote to memory of 1040	1736	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	28

C:\Users\Admin\AppData\Local\Temp\fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe
"C:\Users\Admin\AppData\Local\Temp\fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe
  "C:\Users\Admin\AppData\Local\Temp\fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe"
  2⤵
  PID:1040

memory/1040-57-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1040-58-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1040-61-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/1040-63-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1736-56-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1736-62-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download