a6a3d9347478b4ea72b12d426800e20f99b53244cdc82f1054fa4b893d63943e

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 22:29

Target

4038b0f5b6d73f6f1bf361ec56d9accd.exe
Size

215KB
MD5

4038b0f5b6d73f6f1bf361ec56d9accd
SHA1

58f54341266bf8185ebf7798252e01c4449d34d5
SHA256

a6a3d9347478b4ea72b12d426800e20f99b53244cdc82f1054fa4b893d63943e
SHA512

995f9e09ffbefa8f24fe0723769b5cb980b36fbccd6d8234048c3fdb01a7e40956885f2412df7d61303d9152905f5eec88e36e672e3210e8cd675e58b4f87e70
SSDEEP

3072:8ZCTmNKiBQAeQiObjsFBFM822z3dU+GdtiTnf1aVkoqOID:iCTmNKimTQiObQhaf/UWko

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

4038b0f5b6d73f6f1bf361ec56d9accd.exe

pid	Process
2988	4038b0f5b6d73f6f1bf361ec56d9accd.exe
2988	4038b0f5b6d73f6f1bf361ec56d9accd.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4038b0f5b6d73f6f1bf361ec56d9accd.exe

description	pid	Process	procid_target
PID 2988 wrote to memory of 1624	2988	4038b0f5b6d73f6f1bf361ec56d9accd.exe	28
PID 2988 wrote to memory of 1624	2988	4038b0f5b6d73f6f1bf361ec56d9accd.exe	28
PID 2988 wrote to memory of 1624	2988	4038b0f5b6d73f6f1bf361ec56d9accd.exe	28

C:\Users\Admin\AppData\Local\Temp\4038b0f5b6d73f6f1bf361ec56d9accd.exe
"C:\Users\Admin\AppData\Local\Temp\4038b0f5b6d73f6f1bf361ec56d9accd.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 652
  2⤵
  PID:1624

memory/1624-4-0x0000000001E80000-0x0000000001E81000-memory.dmp

Filesize
4KB

Download
memory/2988-0-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2988-1-0x0000000000AC0000-0x0000000000B40000-memory.dmp

Filesize
512KB

Download
memory/2988-3-0x0000000000AC0000-0x0000000000B40000-memory.dmp

Filesize
512KB

Download
memory/2988-2-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2988-5-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2988-6-0x0000000000AC0000-0x0000000000B40000-memory.dmp

Filesize
512KB

Download