f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed

Analysis

max time kernel
46s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 14:13

Target

f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe
Size

707KB
MD5

af4fdd8f10df20b336226cdc98856570
SHA1

c86d589eabec0e58b47439ae13c698d2a00ae915
SHA256

f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed
SHA512

2ef9d236e591477d1c00eb1870714d4135c36c58cae96c88e85a5aeae1254b1c8e10d2856e1ac3960b13b8ed39de583d5e5ad027e89ea9239b30f24cafe82b2a
SSDEEP

12288:I8ao7YNQ3LPxez8dFlZqBpUzeOXC7g9QjUFfRN+5qJC/hErwqAK:V7wQEz+8DOdrJC/WGK

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 836 set thread context of 1904	836	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1904	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe
1904	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
836	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe
836	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1904	836	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe	27
PID 836 wrote to memory of 1904	836	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe	27
PID 836 wrote to memory of 1904	836	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe	27
PID 836 wrote to memory of 1904	836	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe	27
PID 836 wrote to memory of 1904	836	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe	27
PID 836 wrote to memory of 1904	836	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe	27
PID 836 wrote to memory of 1904	836	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe	27
PID 836 wrote to memory of 1904	836	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe	27
PID 1904 wrote to memory of 1380	1904	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe	14
PID 1904 wrote to memory of 1380	1904	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe	14
PID 1904 wrote to memory of 1380	1904	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe	14
PID 1904 wrote to memory of 1380	1904	f3b3b0f241e737b5c61adeb5fd83dc0840a77eee8f5436818178b70d226034ed.exe	14

memory/836-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/836-55-0x0000000000290000-0x00000000002A0000-memory.dmp

Filesize
64KB

Download
memory/836-56-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/836-57-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/836-58-0x0000000000310000-0x0000000000320000-memory.dmp

Filesize
64KB

Download
memory/836-59-0x0000000000320000-0x0000000000330000-memory.dmp

Filesize
64KB

Download
memory/836-60-0x0000000000330000-0x0000000000340000-memory.dmp

Filesize
64KB

Download
memory/1380-68-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1904-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1904-66-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1904-71-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download