1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f

Analysis

max time kernel
29s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 00:56

Target

1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe
Size

600KB
MD5

0c14b35e5aa6b7e50118a377a8692610
SHA1

1c103d2c08ad74e048786f3061a1bd815288ea45
SHA256

1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f
SHA512

22cf3a419bc0f40a5b4b6bf502c66dea6adc5617173488d8b0d4c4b97941ef484748a55628864edf00e9dfb066525bfe543636601f93a6000c6cfede8e724679
SSDEEP

12288:cUS1/EYUFAlMDChvkdlQh/IltivBZFLMU:c/2OMGmYyWp

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1664	1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe
1880	1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe
1400	1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1880	1664	1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe	29
PID 1664 wrote to memory of 1880	1664	1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe	29
PID 1664 wrote to memory of 1880	1664	1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe	29
PID 1664 wrote to memory of 1880	1664	1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe	29
PID 1664 wrote to memory of 1400	1664	1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe	28
PID 1664 wrote to memory of 1400	1664	1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe	28
PID 1664 wrote to memory of 1400	1664	1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe	28
PID 1664 wrote to memory of 1400	1664	1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe	28

C:\Users\Admin\AppData\Local\Temp\1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe
"C:\Users\Admin\AppData\Local\Temp\1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1400
- C:\Users\Admin\AppData\Local\Temp\1ff531f6872e60acfcce5bb6e793fe9108e3fec1c0b98ace69d45934e315dc7f.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1880

memory/1400-63-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1400-65-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1664-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1664-55-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1664-56-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1664-61-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1880-62-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1880-64-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download