dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 14:01

Target

dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe
Size

96KB
MD5

138ec87d1a13d5ac3f46691b4a53bc74
SHA1

b286888c035606b138a8f0d542a8e296ff0ea110
SHA256

dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33
SHA512

4e5f6a9e78767e3f680aa09b416d00ffe8a05633f6940dfe04c88620de4d19bd8d998e16a1feb5b4478be6ffcd6655cceb8ba15a5ad14573b850938644e66a3d
SSDEEP

1536:nEScmZouhVj7GkKR1zt35Z1jBEf302r6pq:ESTiZRRt35Z9yP02rV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 1340	1756	dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1756	dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe
1340	dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1340	1756	dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe	27
PID 1756 wrote to memory of 1340	1756	dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe	27
PID 1756 wrote to memory of 1340	1756	dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe	27
PID 1756 wrote to memory of 1340	1756	dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe	27
PID 1756 wrote to memory of 1340	1756	dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe	27
PID 1756 wrote to memory of 1340	1756	dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe	27
PID 1756 wrote to memory of 1340	1756	dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe	27
PID 1756 wrote to memory of 1340	1756	dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe	27
PID 1756 wrote to memory of 1340	1756	dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe	27

C:\Users\Admin\AppData\Local\Temp\dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe
"C:\Users\Admin\AppData\Local\Temp\dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe
  "C:\Users\Admin\AppData\Local\Temp\dfca373ea4c53a84cae7143bf59a2bf65c82830b1d77b1abc7a1ab27289d1c33.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1340

memory/1340-55-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1340-60-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1340-58-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1340-56-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1340-66-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1340-67-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1756-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1756-63-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download