f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 22:38

Target

f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe
Size

188KB
MD5

40d12899bc5db37af28e8c97d7e33ea2
SHA1

0d2c7d5ec98ffd259bfaaefff0096b895ddf52cb
SHA256

f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909
SHA512

4b611b72225866ae48ceb13ead374f6342998be17463ad46746520abf2d39ae6737c1158a060ba5a87b4d4d6171136eb5d9244b013306030826cbfaac6e273b1
SSDEEP

1536:4nxWe78VEmj28Kw+0q23SOvozG3EOOdoFhu2dBLz:GxlwvYyq2Cm0G3EOrS+Lz

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 684	1668	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
684	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe
684	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1668	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 684	1668	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe	27
PID 1668 wrote to memory of 684	1668	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe	27
PID 1668 wrote to memory of 684	1668	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe	27
PID 1668 wrote to memory of 684	1668	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe	27
PID 1668 wrote to memory of 684	1668	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe	27
PID 1668 wrote to memory of 684	1668	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe	27
PID 1668 wrote to memory of 684	1668	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe	27
PID 1668 wrote to memory of 684	1668	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe	27
PID 684 wrote to memory of 1268	684	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe	16
PID 684 wrote to memory of 1268	684	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe	16
PID 684 wrote to memory of 1268	684	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe	16
PID 684 wrote to memory of 1268	684	f68a3f0200b6624aa5e6b846b54aff8b5fa7f7530442471f2fc375344ddea909.exe	16

memory/684-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/684-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/684-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/684-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/684-61-0x0000000000407C89-mapping.dmp

Download
memory/684-64-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/684-65-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/684-69-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1268-66-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1668-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download