986b8a2b6760e6a3b0276ac90652a4825d64eb345a091d536233bef9455e15da

Analysis

max time kernel
90s
max time network
98s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 20:41

Target

986b8a2b6760e6a3b0276ac90652a4825d64eb345a091d536233bef9455e15da.exe
Size

673KB
MD5

9ff7ba1e71f3fc1738712e31eb0148c8
SHA1

6cb0fc3571e1e66c5a1e74ee6ffecc4c570fe6c0
SHA256

986b8a2b6760e6a3b0276ac90652a4825d64eb345a091d536233bef9455e15da
SHA512

4abaca08a012eb0e4f22ad60b85865da1a773d66a074cf0357981384f79dd8a9e5d3d5b879e2a2165b04388907af50fd92ccc0461eb147d9c87721ba77a9f191
SSDEEP

12288:Lj3E457KyTskdmz17rg6LyBNisfG+/ZG9F3NkwLME:/3tK0dmSBr/03N3T

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 472	1340	986b8a2b6760e6a3b0276ac90652a4825d64eb345a091d536233bef9455e15da.exe	28
PID 1340 wrote to memory of 472	1340	986b8a2b6760e6a3b0276ac90652a4825d64eb345a091d536233bef9455e15da.exe	28
PID 1340 wrote to memory of 472	1340	986b8a2b6760e6a3b0276ac90652a4825d64eb345a091d536233bef9455e15da.exe	28
PID 1340 wrote to memory of 472	1340	986b8a2b6760e6a3b0276ac90652a4825d64eb345a091d536233bef9455e15da.exe	28
PID 1340 wrote to memory of 768	1340	986b8a2b6760e6a3b0276ac90652a4825d64eb345a091d536233bef9455e15da.exe	29
PID 1340 wrote to memory of 768	1340	986b8a2b6760e6a3b0276ac90652a4825d64eb345a091d536233bef9455e15da.exe	29
PID 1340 wrote to memory of 768	1340	986b8a2b6760e6a3b0276ac90652a4825d64eb345a091d536233bef9455e15da.exe	29
PID 1340 wrote to memory of 768	1340	986b8a2b6760e6a3b0276ac90652a4825d64eb345a091d536233bef9455e15da.exe	29

C:\Users\Admin\AppData\Local\Temp\986b8a2b6760e6a3b0276ac90652a4825d64eb345a091d536233bef9455e15da.exe
"C:\Users\Admin\AppData\Local\Temp\986b8a2b6760e6a3b0276ac90652a4825d64eb345a091d536233bef9455e15da.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Users\Admin\AppData\Local\Temp\986b8a2b6760e6a3b0276ac90652a4825d64eb345a091d536233bef9455e15da.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:472
- C:\Users\Admin\AppData\Local\Temp\986b8a2b6760e6a3b0276ac90652a4825d64eb345a091d536233bef9455e15da.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:768

memory/472-63-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/472-67-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/472-56-0x0000000000000000-mapping.dmp

Download
memory/472-65-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/472-60-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/768-57-0x0000000000000000-mapping.dmp

Download
memory/768-61-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/768-64-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/768-66-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/768-68-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1340-62-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1340-54-0x0000000075611000-0x0000000075613000-memory.dmp

Filesize
8KB

Download
memory/1340-55-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download