e217e7f5986fd524e18536cf112f79386549cfae8f7dba39a9c1e32e13d61b3d

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 16:39

Target

AnyDesk (ETERNAL AIMASSIST WITH BINDS).exe
Size

5.6MB
MD5

310d8ddc72e714af04727915faeb1b2b
SHA1

21352ccd509f8cdf67449199a7fafed00f9ffa88
SHA256

e217e7f5986fd524e18536cf112f79386549cfae8f7dba39a9c1e32e13d61b3d
SHA512

dcfe4bba91029ddae4c4e62af33864975e30146024457acd570c7a79569c98b0c66ec8feec384f709f64ffc1a4be6b18bcdd6041ce674b3c7331047d1fef10bb
SSDEEP

98304:gn8bXMaQhEZq9hQ132dXs2/SG04VH1pTRFrB4b21tbRcW14tek1IHjhPhpGRv+:gn8TYK4fGG8404T9LudW17k2dh2v+

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2160	AnyDesk (ETERNAL AIMASSIST WITH BINDS).exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2160	AnyDesk (ETERNAL AIMASSIST WITH BINDS).exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2768	2160	AnyDesk (ETERNAL AIMASSIST WITH BINDS).exe	29
PID 2160 wrote to memory of 2768	2160	AnyDesk (ETERNAL AIMASSIST WITH BINDS).exe	29
PID 2160 wrote to memory of 2768	2160	AnyDesk (ETERNAL AIMASSIST WITH BINDS).exe	29

C:\Users\Admin\AppData\Local\Temp\AnyDesk (ETERNAL AIMASSIST WITH BINDS).exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk (ETERNAL AIMASSIST WITH BINDS).exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2160 -s 92
  2⤵
  PID:2768

memory/2160-2-0x0000000140000000-0x0000000140A78000-memory.dmp

Filesize
10.5MB

Download
memory/2160-3-0x0000000077180000-0x0000000077182000-memory.dmp

Filesize
8KB

Download
memory/2160-0-0x0000000077180000-0x0000000077182000-memory.dmp

Filesize
8KB

Download
memory/2160-6-0x0000000076FD0000-0x0000000077179000-memory.dmp

Filesize
1.7MB

Download
memory/2160-5-0x0000000077180000-0x0000000077182000-memory.dmp

Filesize
8KB

Download
memory/2160-7-0x0000000077190000-0x0000000077192000-memory.dmp

Filesize
8KB

Download
memory/2160-11-0x0000000077190000-0x0000000077192000-memory.dmp

Filesize
8KB

Download
memory/2160-9-0x0000000077190000-0x0000000077192000-memory.dmp

Filesize
8KB

Download
memory/2160-12-0x0000000140000000-0x0000000140A78000-memory.dmp

Filesize
10.5MB

Download
memory/2160-16-0x0000000140000000-0x0000000140A78000-memory.dmp

Filesize
10.5MB

Download
memory/2160-17-0x0000000076FD0000-0x0000000077179000-memory.dmp

Filesize
1.7MB

Download