dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e

Analysis

max time kernel
227s
max time network
334s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 10:54

Target

dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe
Size

51KB
MD5

7d3fa1569ea697f60a2c2f3e2b1101b0
SHA1

4653cc640ce5737ddd8c7903b05033a86459a063
SHA256

dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e
SHA512

470da36890f82914095d15b2c2305032d30b11f28c2d964fc716c6b3882ea957326692010747e22f557c7e6f46963f4a59ebf4ab80c9af103456ef2bba10a0c8
SSDEEP

768:GAveLekLSoodJ4P11AuQ2TBrl739Y/09jKA0ix9+/y8UwH:LveLekkj4LQ2Vp73Lxxkq8BH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1872 set thread context of 1020	1872	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1020	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe
1020	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1872	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1020	1872	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe	28
PID 1872 wrote to memory of 1020	1872	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe	28
PID 1872 wrote to memory of 1020	1872	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe	28
PID 1872 wrote to memory of 1020	1872	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe	28
PID 1872 wrote to memory of 1020	1872	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe	28
PID 1872 wrote to memory of 1020	1872	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe	28
PID 1872 wrote to memory of 1020	1872	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe	28
PID 1872 wrote to memory of 1020	1872	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe	28
PID 1020 wrote to memory of 1248	1020	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe	17
PID 1020 wrote to memory of 1248	1020	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe	17
PID 1020 wrote to memory of 1248	1020	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe	17
PID 1020 wrote to memory of 1248	1020	dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe	17

C:\Users\Admin\AppData\Local\Temp\dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe
"C:\Users\Admin\AppData\Local\Temp\dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\dbcd53c021733f34b554714d7b62aaccff21388eaff6f200165ff3f5ba84092e.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1020

memory/1020-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1020-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1020-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1020-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1020-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1020-66-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1020-70-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1020-71-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1248-67-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1872-54-0x0000000000400000-0x0000000000406001-memory.dmp

Filesize
24KB

Download
memory/1872-64-0x0000000000400000-0x0000000000406001-memory.dmp

Filesize
24KB

Download