c8e91120db97c2cc33d799fb33cefcb6e199cb68c824500f22ec8fc1736a90b4

Analysis

Target
42d7484c22754ce8f9bc6c5f506f8bf1.exe
Size 60KB
Sample201109-61pe5a6p22
SHA256 c8e91120db97c2cc33d799fb33cefcb6e199cb68c824500f22ec8fc1736a90b4
MD5 42d7484c22754ce8f9bc6c5f506f8bf1
SHA1 ef087ef03536f4e84d6820b38f989745515c9227
SHA512 031902c0ad376013eeeb180b7708b587b3308ea23a454a25582b21fb97e695b93b9349a2f7944299ca4f5dbd7bc2aaf6a2fc7d1f9bb22b8b884307d1206ca3cb
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3980	42d7484c22754ce8f9bc6c5f506f8bf1.exe
2632	42d7484c22754ce8f9bc6c5f506f8bf1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3980 set thread context of 2632	3980	42d7484c22754ce8f9bc6c5f506f8bf1.exe	79

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3980	42d7484c22754ce8f9bc6c5f506f8bf1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3980	42d7484c22754ce8f9bc6c5f506f8bf1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 2632	3980	42d7484c22754ce8f9bc6c5f506f8bf1.exe	79
PID 3980 wrote to memory of 2632	3980	42d7484c22754ce8f9bc6c5f506f8bf1.exe	79
PID 3980 wrote to memory of 2632	3980	42d7484c22754ce8f9bc6c5f506f8bf1.exe	79
PID 3980 wrote to memory of 2632	3980	42d7484c22754ce8f9bc6c5f506f8bf1.exe	79

C:\Users\Admin\AppData\Local\Temp\42d7484c22754ce8f9bc6c5f506f8bf1.exe
"C:\Users\Admin\AppData\Local\Temp\42d7484c22754ce8f9bc6c5f506f8bf1.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Users\Admin\AppData\Local\Temp\42d7484c22754ce8f9bc6c5f506f8bf1.exe
  "C:\Users\Admin\AppData\Local\Temp\42d7484c22754ce8f9bc6c5f506f8bf1.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2632