b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 22:51

Target

b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe
Size

582KB
MD5

9409158e90f92b13442b0769a5b2ccc5
SHA1

3dfa1e8eb09a60f801c8c262158145e549b45284
SHA256

b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed
SHA512

2fada4f2f01c9c0aed8a85d37bba78697fd72fde6c33257ee609f735b2265d90d79ab01615610c904751d3d1369fc356f97b9c12d01ac137ec87bf8890fd5911
SSDEEP

12288:QDTVyi2hTad5RZSSh4tAu+eAhU9Y6z9AfUi7cL:ksUfSS6weAhy9AMtL

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1348 set thread context of 824	1348	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe	26

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
824	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe
824	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1348	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 824	1348	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe	26
PID 1348 wrote to memory of 824	1348	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe	26
PID 1348 wrote to memory of 824	1348	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe	26
PID 1348 wrote to memory of 824	1348	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe	26
PID 1348 wrote to memory of 824	1348	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe	26
PID 1348 wrote to memory of 824	1348	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe	26
PID 1348 wrote to memory of 824	1348	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe	26
PID 1348 wrote to memory of 824	1348	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe	26
PID 824 wrote to memory of 1272	824	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe	16
PID 824 wrote to memory of 1272	824	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe	16
PID 824 wrote to memory of 1272	824	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe	16
PID 824 wrote to memory of 1272	824	b92eeddcc85b8a00ef947479a9a2f9c11f5bd7047aca486f23946d8947e313ed.exe	16

memory/824-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/824-63-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/824-64-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download
memory/824-68-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1272-65-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1348-54-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1348-60-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1348-61-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/1348-62-0x0000000000330000-0x0000000000390000-memory.dmp

Filesize
384KB

Download