adc85a30f77d82a9e872445569740a7c1f5b1a5ad4b9010a8dac217f8a8a1967

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 12:23

Target

adc85a30f77d82a9e872445569740a7c1f5b1a5ad4b9010a8dac217f8a8a1967.exe
Size

24KB
MD5

2c59d8d1be6372a8606468441b077363
SHA1

04f0692c61f03e475bf379c3370e85d8044ac1c2
SHA256

adc85a30f77d82a9e872445569740a7c1f5b1a5ad4b9010a8dac217f8a8a1967
SHA512

8413605924c98ce04fe84ff8d4739fc1c10202dd8c605786e41101fd90706015b470da792f5f0bd0e9a4057638b1032e6312fe8d172d2c173d25803b2b99c130
SSDEEP

96:Ibed5PLzArQq/8A8uQcTWS6rS3gY8bkR31WqT:ISd5DzAcyQHSw5Mx1TT

Score

1^/10

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2816	2472	adc85a30f77d82a9e872445569740a7c1f5b1a5ad4b9010a8dac217f8a8a1967.exe	28
PID 2472 wrote to memory of 2816	2472	adc85a30f77d82a9e872445569740a7c1f5b1a5ad4b9010a8dac217f8a8a1967.exe	28
PID 2472 wrote to memory of 2816	2472	adc85a30f77d82a9e872445569740a7c1f5b1a5ad4b9010a8dac217f8a8a1967.exe	28
PID 2472 wrote to memory of 2816	2472	adc85a30f77d82a9e872445569740a7c1f5b1a5ad4b9010a8dac217f8a8a1967.exe	28
PID 2816 wrote to memory of 1648	2816	wordpad.exe	29
PID 2816 wrote to memory of 1648	2816	wordpad.exe	29
PID 2816 wrote to memory of 1648	2816	wordpad.exe	29
PID 2816 wrote to memory of 1648	2816	wordpad.exe	29

C:\Users\Admin\AppData\Local\Temp\adc85a30f77d82a9e872445569740a7c1f5b1a5ad4b9010a8dac217f8a8a1967.exe
"C:\Users\Admin\AppData\Local\Temp\adc85a30f77d82a9e872445569740a7c1f5b1a5ad4b9010a8dac217f8a8a1967.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
  "C:\Users\Admin\AppData\Local\Temp\adc85a30f77d82a9e872445569740a7c1f5b1a5ad4b9010a8dac217f8a8a1967.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:1648

memory/2472-0-0x0000000001080000-0x0000000001086000-memory.dmp

Filesize
24KB

Download
memory/2816-1-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2816-3-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download