7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204

Analysis

max time kernel
131s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 13:53

Target

7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe
Size

406KB
MD5

7a62bb5ab82276f0cbdce398be804d76
SHA1

6bf7b403573da68906312d29b810001ed0be26f4
SHA256

7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204
SHA512

fc6ec5bb2d50bbe57330e3cdfa5cc127864d334f22ec5630389771c6d5118544fbf45845b4dd09c17d8cde15996611b62b9adc0b73abe1439ecd86c182b5ba91
SSDEEP

12288:tc//////olN/xJUIKt/GsiyGDIt6DZ4cYGZiX:tc//////olr6IWesBeIt4

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\ZPC_MaxToBar.sys	7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1164 set thread context of 1068	1164	7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1212	1068	WerFault.exe	28

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1068	7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe
1068	7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1068	1164	7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe	28
PID 1164 wrote to memory of 1068	1164	7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe	28
PID 1164 wrote to memory of 1068	1164	7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe	28
PID 1164 wrote to memory of 1068	1164	7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe	28
PID 1164 wrote to memory of 1068	1164	7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe	28
PID 1164 wrote to memory of 1068	1164	7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe	28
PID 1068 wrote to memory of 1212	1068	7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe	29
PID 1068 wrote to memory of 1212	1068	7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe	29
PID 1068 wrote to memory of 1212	1068	7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe	29
PID 1068 wrote to memory of 1212	1068	7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe	29

memory/1068-54-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/1068-57-0x000000000047771C-mapping.dmp

Download
memory/1068-56-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/1068-59-0x0000000075151000-0x0000000075153000-memory.dmp

Filesize
8KB

Download
memory/1068-60-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/1068-61-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/1212-62-0x0000000000000000-mapping.dmp

Download