8267f1fbc72a65a9eda42915a68f83cfcdcfda3768907607021414566a0077da

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 11:57

Target

8267f1fbc72a65a9eda42915a68f83cfcdcfda3768907607021414566a0077da.exe
Size

81KB
MD5

bbde52153e9f867dd3073d4d8fccf56d
SHA1

d383aecd1e97db0ed63556331f3030896c2f4dbf
SHA256

8267f1fbc72a65a9eda42915a68f83cfcdcfda3768907607021414566a0077da
SHA512

5ed448e32c485b160b4b83335bec991734b12a58b90391ceb0e6e86bcbded4724865a26ae828e147e2ea77b5e699db46c448971021f37cbc80bb4a99d9a0a6c7
SSDEEP

768:IHNTg7oOJmiOpsk/x2Hy9R2fiNiil7sz2ZQG:uNTwvOpszHy9QR2

Score

1^/10

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2352	1872	8267f1fbc72a65a9eda42915a68f83cfcdcfda3768907607021414566a0077da.exe	28
PID 1872 wrote to memory of 2352	1872	8267f1fbc72a65a9eda42915a68f83cfcdcfda3768907607021414566a0077da.exe	28
PID 1872 wrote to memory of 2352	1872	8267f1fbc72a65a9eda42915a68f83cfcdcfda3768907607021414566a0077da.exe	28
PID 1872 wrote to memory of 2352	1872	8267f1fbc72a65a9eda42915a68f83cfcdcfda3768907607021414566a0077da.exe	28
PID 2352 wrote to memory of 2192	2352	wordpad.exe	29
PID 2352 wrote to memory of 2192	2352	wordpad.exe	29
PID 2352 wrote to memory of 2192	2352	wordpad.exe	29
PID 2352 wrote to memory of 2192	2352	wordpad.exe	29

C:\Users\Admin\AppData\Local\Temp\8267f1fbc72a65a9eda42915a68f83cfcdcfda3768907607021414566a0077da.exe
"C:\Users\Admin\AppData\Local\Temp\8267f1fbc72a65a9eda42915a68f83cfcdcfda3768907607021414566a0077da.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
  "C:\Users\Admin\AppData\Local\Temp\8267f1fbc72a65a9eda42915a68f83cfcdcfda3768907607021414566a0077da.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:2192

memory/1872-0-0x00000000008B0000-0x00000000008C2000-memory.dmp

Filesize
72KB

Download
memory/2352-1-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/2352-3-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download