7ddeac42dcbc03a6cf9af46903f86fa1907510c90ecacbd8b346a839c408de12

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 23:10

Target

185fb4b70dd703cb896a69a1c2f43a0f.exe
Size

305KB
MD5

185fb4b70dd703cb896a69a1c2f43a0f
SHA1

71cf8211ac20c8cb9c9cfec9f6d31bb161eb24bd
SHA256

7ddeac42dcbc03a6cf9af46903f86fa1907510c90ecacbd8b346a839c408de12
SHA512

e4555e4ee32033c79fdccf89659bf24547a82a4caa48908d954ce3e3eb75e09019b3427d86a89b2f10cb67c597bdec0a6e7372f39c327d9d83398fdef987fb87
SSDEEP

3072:oVjdimC4s7YvU9s8uJzqrcH0Yi1crjUcA2WKwDDUJUVLfiptM06pjtw4v8s99I8Q:bCxQ5c

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 1056	1712	185fb4b70dd703cb896a69a1c2f43a0f.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1056	185fb4b70dd703cb896a69a1c2f43a0f.exe
1056	185fb4b70dd703cb896a69a1c2f43a0f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1712	185fb4b70dd703cb896a69a1c2f43a0f.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1056	1712	185fb4b70dd703cb896a69a1c2f43a0f.exe	28
PID 1712 wrote to memory of 1056	1712	185fb4b70dd703cb896a69a1c2f43a0f.exe	28
PID 1712 wrote to memory of 1056	1712	185fb4b70dd703cb896a69a1c2f43a0f.exe	28
PID 1712 wrote to memory of 1056	1712	185fb4b70dd703cb896a69a1c2f43a0f.exe	28
PID 1712 wrote to memory of 1056	1712	185fb4b70dd703cb896a69a1c2f43a0f.exe	28
PID 1712 wrote to memory of 1056	1712	185fb4b70dd703cb896a69a1c2f43a0f.exe	28
PID 1712 wrote to memory of 1056	1712	185fb4b70dd703cb896a69a1c2f43a0f.exe	28
PID 1712 wrote to memory of 1056	1712	185fb4b70dd703cb896a69a1c2f43a0f.exe	28
PID 1056 wrote to memory of 1220	1056	185fb4b70dd703cb896a69a1c2f43a0f.exe	19
PID 1056 wrote to memory of 1220	1056	185fb4b70dd703cb896a69a1c2f43a0f.exe	19
PID 1056 wrote to memory of 1220	1056	185fb4b70dd703cb896a69a1c2f43a0f.exe	19
PID 1056 wrote to memory of 1220	1056	185fb4b70dd703cb896a69a1c2f43a0f.exe	19

memory/1056-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1056-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1056-5-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1056-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1056-11-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1056-24-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1220-8-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1220-12-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download