9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 16:50

Target

9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe
Size

76KB
MD5

fba11e1ec00f5fb0a61e60a3ec58e273
SHA1

83187d71a66731044123f5f03e95abb8cb5681d1
SHA256

9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704
SHA512

0172dbf3398a9631e41db0fb611d9817c40c1e8c2babd858488f521e53a335028a9b4983e47223b7eb8b6ced617debd98d7b5933373af405e78feef6c8e8b48f
SSDEEP

1536:GBx77D6OCvnMc99BB9DD6OCn8FFPHODY2kuhws+/zGYBGo51:i7eOC0q9pDeOCn8F9qklz1Go51

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 1020	900	9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
900	9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe
1020	9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1020	900	9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe	27
PID 900 wrote to memory of 1020	900	9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe	27
PID 900 wrote to memory of 1020	900	9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe	27
PID 900 wrote to memory of 1020	900	9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe	27
PID 900 wrote to memory of 1020	900	9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe	27
PID 900 wrote to memory of 1020	900	9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe	27
PID 900 wrote to memory of 1020	900	9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe	27
PID 900 wrote to memory of 1020	900	9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe	27
PID 900 wrote to memory of 1020	900	9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe	27

C:\Users\Admin\AppData\Local\Temp\9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe
"C:\Users\Admin\AppData\Local\Temp\9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Temp\9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe
  "C:\Users\Admin\AppData\Local\Temp\9302a1477d73fe14229aefb89ad73a1310fafde5a4be02f55dab73cf9c299704.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1020

memory/900-61-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1020-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1020-62-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1020-63-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download