d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 07:15

Target

d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe
Size

600KB
MD5

46d38cfe2b468e43a579aa1313e200e0
SHA1

2151848bfa8097e2cd2b4bba884f037a0255b134
SHA256

d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b
SHA512

d0ae0b0c3f5dc818ad1b998bb21e2b9ab6625d4f3ad83469c712c4e246daf1e5d7baae7f5dff6c1b7372aaa3b91315e516b06b36b84d4a22a6b7de36e95f2852
SSDEEP

12288:2UfFdaJfEaXmAnd9a7SBHRDXIltivUi+FLMs:2Uja3X5neGBH1XyWXK

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1416	d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe
540	d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe
1556	d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 540	1416	d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe	26
PID 1416 wrote to memory of 540	1416	d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe	26
PID 1416 wrote to memory of 540	1416	d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe	26
PID 1416 wrote to memory of 540	1416	d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe	26
PID 1416 wrote to memory of 1556	1416	d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe	27
PID 1416 wrote to memory of 1556	1416	d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe	27
PID 1416 wrote to memory of 1556	1416	d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe	27
PID 1416 wrote to memory of 1556	1416	d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe	27

C:\Users\Admin\AppData\Local\Temp\d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe
"C:\Users\Admin\AppData\Local\Temp\d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:540
- C:\Users\Admin\AppData\Local\Temp\d8f67763e08f90a75d837a741af99d8cd6eea6971483614e28a36cffc0b8f01b.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1556

memory/540-65-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/540-61-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/540-63-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/540-67-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1416-55-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1416-60-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1416-54-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/1556-62-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1556-64-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1556-66-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1556-68-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download