f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121

Analysis

max time kernel
45s
max time network
73s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 09:28

Target

f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe
Size

578KB
MD5

0c30020a053f51cc33f33478462ad940
SHA1

8727ce1bb86a1038ae26395e2f9fe99a51559d4e
SHA256

f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121
SHA512

6d2161a8aa35f765e997c9b65fa39d0e892ed50a1bab1e86300061e5349b2f07caa6f75cd90b663584fa2efd9c1d1631692624509abc82a08e509eed3362b527
SSDEEP

12288:mRHQGHVgQvJr4X5f/0Q0nTzcBSl9YqbfhIM66Ci:qB3h4x0MwliyEE

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1952	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe
1128	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe
268	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1128	1952	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe	28
PID 1952 wrote to memory of 1128	1952	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe	28
PID 1952 wrote to memory of 1128	1952	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe	28
PID 1952 wrote to memory of 1128	1952	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe	28
PID 1952 wrote to memory of 268	1952	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe	29
PID 1952 wrote to memory of 268	1952	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe	29
PID 1952 wrote to memory of 268	1952	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe	29
PID 1952 wrote to memory of 268	1952	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe	29

C:\Users\Admin\AppData\Local\Temp\f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe
"C:\Users\Admin\AppData\Local\Temp\f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1128
- C:\Users\Admin\AppData\Local\Temp\f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:268

memory/268-61-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/268-63-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1128-60-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1128-62-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1952-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1952-59-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download