9671aa55a34fcecf2291e8173a407782d113f40f74b002ac3c02c89f0b04b454

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 16:31

Target

7ce20695a046d0aed64f1fb1e0c83d22.exe
Size

592KB
MD5

7ce20695a046d0aed64f1fb1e0c83d22
SHA1

5595c9c81e90ac320d6c90da35c87a69743da69b
SHA256

9671aa55a34fcecf2291e8173a407782d113f40f74b002ac3c02c89f0b04b454
SHA512

494e4af7d9c384879e202850418d7a045b8419ae9967527b6410f20b30a97b61dca8304e4f14e6090bcda11216056dc6faa8b12bec4c76c9688faaf64227fe74
SSDEEP

3072:4Fb5LlM11Gvbec1YdRmbh8f4TCsKp9hJm/KzopkhUrloBLCWZ1wK/+70uCYpd4R/:oec8mbajsKdJ6KzopzrloR9wK/oyRDh

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1340 set thread context of 2292	1340	7ce20695a046d0aed64f1fb1e0c83d22.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1340	7ce20695a046d0aed64f1fb1e0c83d22.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2292	1340	7ce20695a046d0aed64f1fb1e0c83d22.exe	28
PID 1340 wrote to memory of 2292	1340	7ce20695a046d0aed64f1fb1e0c83d22.exe	28
PID 1340 wrote to memory of 2292	1340	7ce20695a046d0aed64f1fb1e0c83d22.exe	28
PID 1340 wrote to memory of 2292	1340	7ce20695a046d0aed64f1fb1e0c83d22.exe	28
PID 1340 wrote to memory of 2292	1340	7ce20695a046d0aed64f1fb1e0c83d22.exe	28
PID 1340 wrote to memory of 2292	1340	7ce20695a046d0aed64f1fb1e0c83d22.exe	28
PID 1340 wrote to memory of 2292	1340	7ce20695a046d0aed64f1fb1e0c83d22.exe	28
PID 1340 wrote to memory of 2292	1340	7ce20695a046d0aed64f1fb1e0c83d22.exe	28

C:\Users\Admin\AppData\Local\Temp\7ce20695a046d0aed64f1fb1e0c83d22.exe
"C:\Users\Admin\AppData\Local\Temp\7ce20695a046d0aed64f1fb1e0c83d22.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Users\Admin\AppData\Local\Temp\7ce20695a046d0aed64f1fb1e0c83d22.exe
  C:\Users\Admin\AppData\Local\Temp\7ce20695a046d0aed64f1fb1e0c83d22.exe
  2⤵
  PID:2292

memory/2292-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2292-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2292-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2292-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2292-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2292-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2292-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2292-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2292-15-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2292-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download