0a49dc0d2ce725af347df632539b70afcfd22b38e285920b515143332a5511e9

Resubmissions

17/03/2023, 11:28

17/03/2023, 11:16

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17/03/2023, 11:28

Target

TCPOptimizer.exe
Size

668KB
MD5

d8292150c8ce862a97a923318df07805
SHA1

917f917ff9fe33e199388e5e1d4c0696882d2991
SHA256

0a49dc0d2ce725af347df632539b70afcfd22b38e285920b515143332a5511e9
SHA512

3f23dd72d066d3f09a49c5dcf062471cfd412cf65934c25887774c1060d2efa8cb277df5ffb89272c5cb1aab6498e3e82b9d6ec9725b5b7263de60cc9198d475
SSDEEP

6144:h0eD/NMpAte8M0Ic61arFbMAIhTRlDDHbndz+vTEEIeh+b6YzICrz/KiiUy5q7:C1B8g1arhMAURdndzQTEEI7b6Yz3m5W

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1984	TCPOptimizer.exe
1984	TCPOptimizer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1972	1984	TCPOptimizer.exe	27
PID 1984 wrote to memory of 1972	1984	TCPOptimizer.exe	27
PID 1984 wrote to memory of 1972	1984	TCPOptimizer.exe	27
PID 1984 wrote to memory of 1972	1984	TCPOptimizer.exe	27
PID 1984 wrote to memory of 1752	1984	TCPOptimizer.exe	29
PID 1984 wrote to memory of 1752	1984	TCPOptimizer.exe	29
PID 1984 wrote to memory of 1752	1984	TCPOptimizer.exe	29
PID 1984 wrote to memory of 1752	1984	TCPOptimizer.exe	29
PID 1984 wrote to memory of 1608	1984	TCPOptimizer.exe	31
PID 1984 wrote to memory of 1608	1984	TCPOptimizer.exe	31
PID 1984 wrote to memory of 1608	1984	TCPOptimizer.exe	31
PID 1984 wrote to memory of 1608	1984	TCPOptimizer.exe	31
PID 1984 wrote to memory of 1168	1984	TCPOptimizer.exe	33
PID 1984 wrote to memory of 1168	1984	TCPOptimizer.exe	33
PID 1984 wrote to memory of 1168	1984	TCPOptimizer.exe	33
PID 1984 wrote to memory of 1168	1984	TCPOptimizer.exe	33

C:\Users\Admin\AppData\Local\Temp\TCPOptimizer.exe
"C:\Users\Admin\AppData\Local\Temp\TCPOptimizer.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\netsh.exe
  netsh int tcp show supplemental
  2⤵
  PID:1972
- C:\Windows\system32\netsh.exe
  netsh int ip show interfaces
  2⤵
  PID:1752
- C:\Windows\system32\netsh.exe
  netsh interface tcp show global
  2⤵
  PID:1608
- C:\Windows\system32\netsh.exe
  netsh interface tcp show heuristics
  2⤵
  PID:1168