ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4

Analysis

max time kernel
9s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 16:46

Target

ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe
Size

87KB
MD5

a899c619a5ac047525c054a7f69c4e56
SHA1

3fd3ca19c1bbfed0c8cfb0e9adf93270ecf30448
SHA256

ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4
SHA512

a71f1c53fbe26ffb4030f25a1736ff6639a038b3f6c8f391e2d1d37019792b1aeeba8d8a33c266b1d67d55d46e36e3ad7504669bda710009029fef0f384af27e
SSDEEP

1536:Te512dd6yKNgAPO1ognSg0X8WIEkrqIPhLuclBfXJfevWOKGGbff:Te512ddlKNBGognqsxtOYQWOFGbff

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 952 set thread context of 1484	952	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1904	1484	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
952	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1484	952	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe	28
PID 952 wrote to memory of 1484	952	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe	28
PID 952 wrote to memory of 1484	952	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe	28
PID 952 wrote to memory of 1484	952	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe	28
PID 952 wrote to memory of 1484	952	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe	28
PID 952 wrote to memory of 1484	952	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe	28
PID 952 wrote to memory of 1484	952	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe	28
PID 952 wrote to memory of 1484	952	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe	28
PID 952 wrote to memory of 1484	952	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe	28
PID 952 wrote to memory of 1484	952	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe	28
PID 1484 wrote to memory of 1904	1484	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe	29
PID 1484 wrote to memory of 1904	1484	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe	29
PID 1484 wrote to memory of 1904	1484	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe	29
PID 1484 wrote to memory of 1904	1484	ef1f4546f9254dd1ad33fed6622e8fd444942d29d59148d8d52eab0ddbcc92b4.exe	29

memory/952-70-0x0000000000400000-0x0000000000409001-memory.dmp

Filesize
36KB

Download
memory/1484-56-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1484-57-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1484-59-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1484-61-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1484-63-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1484-66-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1484-69-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download