ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2

Analysis

max time kernel
36s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 12:15

Target

ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2.exe
Size

216KB
MD5

49091324d6c276c37abf56a77a8aaf04
SHA1

84999c239b5eb95a15309e8543f40cc4f1834303
SHA256

ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2
SHA512

a102b2d68f78f29e8c571a69a7a01478df77ea49897fab155333fed3bd6c4e20525ec1690b63345142824f44b82de3c7f7944379fa4bb053a308862985ea4efd
SSDEEP

6144:dGuuD4yVkyvuQ4a8I7JAFyDeOsjic3kyfHqc3kyL6ULcbPh4HXu:Q1r2Qn99cyyfAyL5cbPl

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1128 set thread context of 2028	1128	ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
468	2028	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1128	ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2028	1128	ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2.exe	28
PID 1128 wrote to memory of 2028	1128	ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2.exe	28
PID 1128 wrote to memory of 2028	1128	ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2.exe	28
PID 1128 wrote to memory of 2028	1128	ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2.exe	28
PID 1128 wrote to memory of 2028	1128	ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2.exe	28
PID 1128 wrote to memory of 2028	1128	ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2.exe	28
PID 1128 wrote to memory of 2028	1128	ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2.exe	28
PID 1128 wrote to memory of 2028	1128	ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2.exe	28
PID 2028 wrote to memory of 468	2028	ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2.exe	29
PID 2028 wrote to memory of 468	2028	ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2.exe	29
PID 2028 wrote to memory of 468	2028	ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2.exe	29
PID 2028 wrote to memory of 468	2028	ee632ba9350223284922ffdda0f76e0400397ef822025a146b9ce7c6a932e3f2.exe	29

memory/1128-54-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1128-65-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2028-57-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2028-58-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2028-59-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2028-61-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2028-63-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2028-67-0x0000000000400000-0x0000000000402200-memory.dmp

Filesize
8KB

Download