8a20b5d05e26057121e8b11bf59ab7d2021665b15d0d6666e538c24c491d8c40

Analysis

max time kernel
53s
max time network
60s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
16-08-2023 20:51

Target

7b636314a425c887a023e28ed1418f1773e2dd4514809c3fac645d5963c3dc64.exe
Size

13.1MB
MD5

12439d7d1061cc9c59fa3e06014230e8
SHA1

eaed640513fcf6487dad74ea8cc0d01a53fb60c1
SHA256

7b636314a425c887a023e28ed1418f1773e2dd4514809c3fac645d5963c3dc64
SHA512

812768feeade9ed5175a9a26baa10c320b8cff3687e980a3582d1a82dc543412349e94c0a61930df1ba4432bfad56906c8f163e3a9cf385b337df6b01087c3a0
SSDEEP

393216:5xmg78shAlD7Xln3Skes39NZx7v1M4SWXw:18shAN7tpPP7vu

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3396	7b636314a425c887a023e28ed1418f1773e2dd4514809c3fac645d5963c3dc64.exe
3396	7b636314a425c887a023e28ed1418f1773e2dd4514809c3fac645d5963c3dc64.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 4524	3396	7b636314a425c887a023e28ed1418f1773e2dd4514809c3fac645d5963c3dc64.exe	71
PID 3396 wrote to memory of 4524	3396	7b636314a425c887a023e28ed1418f1773e2dd4514809c3fac645d5963c3dc64.exe	71
PID 3396 wrote to memory of 4524	3396	7b636314a425c887a023e28ed1418f1773e2dd4514809c3fac645d5963c3dc64.exe	71

C:\Users\Admin\AppData\Local\Temp\7b636314a425c887a023e28ed1418f1773e2dd4514809c3fac645d5963c3dc64.exe
"C:\Users\Admin\AppData\Local\Temp\7b636314a425c887a023e28ed1418f1773e2dd4514809c3fac645d5963c3dc64.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4524

memory/3396-122-0x0000000000120000-0x0000000001686000-memory.dmp

Filesize
21.4MB

Download
memory/3396-123-0x00000000017F0000-0x00000000017F1000-memory.dmp

Filesize
4KB

Download
memory/3396-124-0x0000000001BD0000-0x0000000001BD1000-memory.dmp

Filesize
4KB

Download
memory/3396-126-0x0000000000120000-0x0000000001686000-memory.dmp

Filesize
21.4MB

Download
memory/3396-125-0x0000000000120000-0x0000000001686000-memory.dmp

Filesize
21.4MB

Download
memory/3396-133-0x00000000778D4000-0x00000000778D5000-memory.dmp

Filesize
4KB

Download
memory/3396-134-0x0000000000120000-0x0000000001686000-memory.dmp

Filesize
21.4MB

Download