9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3

Analysis

max time kernel
65s
max time network
64s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 16:50

Target

9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe
Size

116KB
MD5

54f6d6c23774a6481f8393653a78a058
SHA1

e9d7e077a6552479d50911a549f8bf2dc661a1ba
SHA256

9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3
SHA512

e1d042d275c5e2c70d94f8cc9fb470537244dea34b4cba1e532967a57b2e066c9caa20f7985d37974d80d6523372da0d9a109e2571f54016df27d99b2292e0fc
SSDEEP

3072:pwtzlcQEiTNKu+qd2PbcSOOxr+51ueB0E0t:pHQEiTkugbcSO+rPE0t

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1388 set thread context of 1472	1388	9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1388	9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1472	1388	9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe	26
PID 1388 wrote to memory of 1472	1388	9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe	26
PID 1388 wrote to memory of 1472	1388	9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe	26
PID 1388 wrote to memory of 1472	1388	9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe	26
PID 1388 wrote to memory of 1472	1388	9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe	26
PID 1388 wrote to memory of 1472	1388	9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe	26
PID 1388 wrote to memory of 1472	1388	9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe	26
PID 1388 wrote to memory of 1472	1388	9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe	26
PID 1388 wrote to memory of 1472	1388	9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe	26
PID 1388 wrote to memory of 1472	1388	9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe	26
PID 1388 wrote to memory of 1472	1388	9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe	26
PID 1388 wrote to memory of 1472	1388	9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe	26

C:\Users\Admin\AppData\Local\Temp\9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe
"C:\Users\Admin\AppData\Local\Temp\9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.EXE
  "C:\Users\Admin\AppData\Local\Temp\9637daf3c1042b609cd74ccefca4da56bc17d126a9cdd61b2d0def879d539ae3.EXE"
  2⤵
  PID:1472

memory/1388-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1472-58-0x0000000000453E70-mapping.dmp

Download
memory/1472-57-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1472-60-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1472-63-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1472-64-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1472-65-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1472-66-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download