a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0

Analysis

max time kernel
31s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:49

Target

a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe
Size

78KB
MD5

75468604f1c68fc1c214ee4690700910
SHA1

ef39a7c11d237346d347fc7fa97681aefcfaaafd
SHA256

a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0
SHA512

9869402e90698e4b34b2c70e5ee7a24e1357fe49a563a0dccbdc72f9a64d37dd50dbd6ddb684b974ddef1efbb3461a64e31f7462b5c363bb7289735d3bde0506
SSDEEP

1536:bPKkTa0gD3jYsl6iRepdqokVyn0cKvWB6qAxxYvgAirBke:lGD3EE2VQyqvUAx9JrBke

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1952 set thread context of 1192	1952	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1192	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe
1192	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1952	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1192	1952	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe	28
PID 1952 wrote to memory of 1192	1952	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe	28
PID 1952 wrote to memory of 1192	1952	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe	28
PID 1952 wrote to memory of 1192	1952	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe	28
PID 1952 wrote to memory of 1192	1952	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe	28
PID 1952 wrote to memory of 1192	1952	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe	28
PID 1952 wrote to memory of 1192	1952	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe	28
PID 1952 wrote to memory of 1192	1952	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe	28
PID 1192 wrote to memory of 1196	1192	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe	11
PID 1192 wrote to memory of 1196	1192	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe	11
PID 1192 wrote to memory of 1196	1192	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe	11
PID 1192 wrote to memory of 1196	1192	a0ead3aa4413f96ecd2d9fe8c773ab84ca1395178b78a0f0b421f4eebf4502c0.exe	11

memory/1192-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1192-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1192-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1192-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1192-65-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1192-66-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/1192-70-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1196-67-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1952-55-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1952-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download