221aab880c468ec670c8d35546206381b6f643fae2b7a62e6346f1bc9a52dd3e

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:05

Target

1481ef11e6802b82ba272ffa154f4b64.exe
Size

601KB
MD5

1481ef11e6802b82ba272ffa154f4b64
SHA1

d35e60906614c715a52c3f9fbb774334ea1ae226
SHA256

221aab880c468ec670c8d35546206381b6f643fae2b7a62e6346f1bc9a52dd3e
SHA512

237af16d6757d6807000266a4cd75767b7bab6bd1769f9c18306ba16484b2310eaa024e01e078206af31254187e68258cd29c336f09a96d6a102cc72ff845d63
SSDEEP

12288:KSracAq96saVWWgQp/mfwRDYdyRgvZXqyd8BwxpImEcM66C2:KS+c796saVWqmYXRgv8BOpImEu4

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2672	1444	1481ef11e6802b82ba272ffa154f4b64.exe	28
PID 1444 wrote to memory of 2672	1444	1481ef11e6802b82ba272ffa154f4b64.exe	28
PID 1444 wrote to memory of 2672	1444	1481ef11e6802b82ba272ffa154f4b64.exe	28
PID 1444 wrote to memory of 2672	1444	1481ef11e6802b82ba272ffa154f4b64.exe	28
PID 1444 wrote to memory of 2728	1444	1481ef11e6802b82ba272ffa154f4b64.exe	29
PID 1444 wrote to memory of 2728	1444	1481ef11e6802b82ba272ffa154f4b64.exe	29
PID 1444 wrote to memory of 2728	1444	1481ef11e6802b82ba272ffa154f4b64.exe	29
PID 1444 wrote to memory of 2728	1444	1481ef11e6802b82ba272ffa154f4b64.exe	29

C:\Users\Admin\AppData\Local\Temp\1481ef11e6802b82ba272ffa154f4b64.exe
"C:\Users\Admin\AppData\Local\Temp\1481ef11e6802b82ba272ffa154f4b64.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\1481ef11e6802b82ba272ffa154f4b64.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\1481ef11e6802b82ba272ffa154f4b64.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2728

memory/1444-4-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1444-0-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1444-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1444-3-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1444-5-0x0000000001D00000-0x0000000001D9A000-memory.dmp

Filesize
616KB

Download
memory/1444-10-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1444-1-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2672-9-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2672-7-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2672-12-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2672-13-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2728-8-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2728-6-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2728-11-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2728-14-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download