bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3

Analysis

max time kernel
46s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:42

Target

bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe
Size

340KB
MD5

aecb98af93e575e3ec917e4fa716ebaf
SHA1

d1d0c2689cadecebb95b70e92877db791c8c6371
SHA256

bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3
SHA512

2a73ae9a7955523c524ef8f47d5ea78dc22430049bef7402b647007322d1a2bbd328802b5faeb085ce5931fab79196ad986569964b5f99af968b6b812a5a2f5e
SSDEEP

6144:+X2U6D1taTtP1gf1/P7FTk8s1HZSyok5Az9hAtEm7gMuCKczll9/bzrF:wM1t8Jifnk8o5qUtEm7HurK/3Z

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1352 set thread context of 832	1352	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
832	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe
832	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1352	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 832	1352	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe	28
PID 1352 wrote to memory of 832	1352	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe	28
PID 1352 wrote to memory of 832	1352	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe	28
PID 1352 wrote to memory of 832	1352	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe	28
PID 1352 wrote to memory of 832	1352	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe	28
PID 1352 wrote to memory of 832	1352	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe	28
PID 1352 wrote to memory of 832	1352	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe	28
PID 1352 wrote to memory of 832	1352	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe	28
PID 832 wrote to memory of 1272	832	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe	11
PID 832 wrote to memory of 1272	832	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe	11
PID 832 wrote to memory of 1272	832	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe	11
PID 832 wrote to memory of 1272	832	bf4ef83105f9470c8c80cabd158fdeeb9674a39df0a3b636b922223f325650f3.exe	11

memory/832-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/832-62-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/832-63-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/832-67-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1272-64-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1352-54-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download
memory/1352-55-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download
memory/1352-61-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download