9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 10:40

Target

9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe
Size

28KB
MD5

674784c59dfdd23ba5a16096d52e361f
SHA1

4da93c9183c9bc8c131743a5dce7d6514e2d47a7
SHA256

9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00
SHA512

24295726903edf012ea10b7853f89d39944ab538c4fab6be1425374378faee8a9b19bf5511bc955ed6f04b125dd0bbe1f8c25582444ce789a4c72186c9d61816
SSDEEP

384:8RMqL0Vv2V5v4oQSxUXuXn5VfdEvoHAw:8LJX4qxUepVuvb

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\calc.exe	9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1512 set thread context of 280	1512	9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1512	9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 280	1512	9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe	27
PID 1512 wrote to memory of 280	1512	9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe	27
PID 1512 wrote to memory of 280	1512	9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe	27
PID 1512 wrote to memory of 280	1512	9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe	27
PID 1512 wrote to memory of 280	1512	9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe	27
PID 1512 wrote to memory of 280	1512	9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe	27
PID 1512 wrote to memory of 280	1512	9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe	27
PID 1512 wrote to memory of 280	1512	9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe	27
PID 1512 wrote to memory of 280	1512	9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe	27
PID 1512 wrote to memory of 280	1512	9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe	27

C:\Users\Admin\AppData\Local\Temp\9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe
"C:\Users\Admin\AppData\Local\Temp\9f7ab1eea1692fa623b6974a33f301ce1dd09c24618f9ca9db45ec8bdfbdcd00.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\notepad.exe
  C:\Windows\SYSTEM32\notepad.exe
  2⤵
  PID:280

memory/280-56-0x0000000001000000-0x00000000010C0000-memory.dmp

Filesize
768KB

Download
memory/280-59-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/280-60-0x0000000001000000-0x00000000010C0000-memory.dmp

Filesize
768KB

Download
memory/280-61-0x0000000001000000-0x00000000010C0000-memory.dmp

Filesize
768KB

Download