9a12d141eef4c1094654e69a1ed069ec1148f73c98d26ce516d0ca24b1fe174a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25/04/2023, 17:27

Target

HEUR-Trojan.Win32.exe
Size

128KB
MD5

5ec96b67ac6587cc4bbfef31e7d1f248
SHA1

9776341d2473c3d1e7e4a8046a3e9e772d6aa664
SHA256

9a12d141eef4c1094654e69a1ed069ec1148f73c98d26ce516d0ca24b1fe174a
SHA512

50c3e5e2c3a7d57df3d21f7c858095416bad037f5cf415ea52d6998db23459fa4908dd25ace9d8b943f79b92f580744bb9ecbf3c081416d33d3bf98accb971fc
SSDEEP

3072:YdgRDhNuD6K1b9wGRUTPipLDjm2sKaOyQ+xv3Vgefy6Ep:YajuD6O3RWwLDjmJKao+lFj3Ep

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 1164	2028	HEUR-Trojan.Win32.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2028	HEUR-Trojan.Win32.exe
2028	HEUR-Trojan.Win32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1164	2028	HEUR-Trojan.Win32.exe	27
PID 2028 wrote to memory of 1164	2028	HEUR-Trojan.Win32.exe	27
PID 2028 wrote to memory of 1164	2028	HEUR-Trojan.Win32.exe	27
PID 2028 wrote to memory of 1164	2028	HEUR-Trojan.Win32.exe	27
PID 2028 wrote to memory of 1164	2028	HEUR-Trojan.Win32.exe	27
PID 2028 wrote to memory of 1164	2028	HEUR-Trojan.Win32.exe	27
PID 2028 wrote to memory of 1164	2028	HEUR-Trojan.Win32.exe	27
PID 2028 wrote to memory of 1164	2028	HEUR-Trojan.Win32.exe	27
PID 2028 wrote to memory of 1164	2028	HEUR-Trojan.Win32.exe	27

C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe
  C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe
  2⤵
  PID:1164

memory/1164-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1164-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1164-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1164-57-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1164-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1164-58-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1164-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1164-63-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2028-61-0x00000000001E0000-0x00000000001E4000-memory.dmp

Filesize
16KB

Download