504f5a40f23ba89f95131e8a431179fe18c10b337b0c6158219aa46f05a43e17

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 23:02

Target

41eb5b0768ffd43d66e745a8bd40b90a.exe
Size

188KB
MD5

41eb5b0768ffd43d66e745a8bd40b90a
SHA1

fb6726dba95c1c071ba4e0f2132045ebdba52fd2
SHA256

504f5a40f23ba89f95131e8a431179fe18c10b337b0c6158219aa46f05a43e17
SHA512

a30099ebeb0a679cdafef131d646dab9b58b1adc391141f58232106b383666ca8a25ba432c0d6a0084d38ef225c61d18b725788c0ea5d7ecea8836d9459135ed
SSDEEP

3072:hQ9wRShnMOqbFjEcWTZsMO+7eSeaHLygJjQ88GF548EleR:hQmRSXqOcWjaSjWOjPvF54u

Score

5^/10

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 1760	1688	41eb5b0768ffd43d66e745a8bd40b90a.exe	28
PID 1688 set thread context of 0	1688	41eb5b0768ffd43d66e745a8bd40b90a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1760	41eb5b0768ffd43d66e745a8bd40b90a.exe
1760	41eb5b0768ffd43d66e745a8bd40b90a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1688	41eb5b0768ffd43d66e745a8bd40b90a.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1760	1688	41eb5b0768ffd43d66e745a8bd40b90a.exe	28
PID 1688 wrote to memory of 1760	1688	41eb5b0768ffd43d66e745a8bd40b90a.exe	28
PID 1688 wrote to memory of 1760	1688	41eb5b0768ffd43d66e745a8bd40b90a.exe	28
PID 1688 wrote to memory of 1760	1688	41eb5b0768ffd43d66e745a8bd40b90a.exe	28
PID 1688 wrote to memory of 1760	1688	41eb5b0768ffd43d66e745a8bd40b90a.exe	28
PID 1688 wrote to memory of 1760	1688	41eb5b0768ffd43d66e745a8bd40b90a.exe	28
PID 1688 wrote to memory of 1760	1688	41eb5b0768ffd43d66e745a8bd40b90a.exe	28
PID 1688 wrote to memory of 1760	1688	41eb5b0768ffd43d66e745a8bd40b90a.exe	28
PID 1688 wrote to memory of 0	1688	41eb5b0768ffd43d66e745a8bd40b90a.exe
PID 1688 wrote to memory of 0	1688	41eb5b0768ffd43d66e745a8bd40b90a.exe
PID 1688 wrote to memory of 0	1688	41eb5b0768ffd43d66e745a8bd40b90a.exe
PID 1688 wrote to memory of 0	1688	41eb5b0768ffd43d66e745a8bd40b90a.exe
PID 1760 wrote to memory of 1244	1760	41eb5b0768ffd43d66e745a8bd40b90a.exe	22
PID 1760 wrote to memory of 1244	1760	41eb5b0768ffd43d66e745a8bd40b90a.exe	22
PID 1760 wrote to memory of 1244	1760	41eb5b0768ffd43d66e745a8bd40b90a.exe	22
PID 1760 wrote to memory of 1244	1760	41eb5b0768ffd43d66e745a8bd40b90a.exe	22

memory/1244-17-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1244-14-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1688-11-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1688-2-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1688-1-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1688-3-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1688-6-0x0000000000470000-0x00000000004D4000-memory.dmp

Filesize
400KB

Download
memory/1688-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1760-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1760-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1760-13-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1760-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1760-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1760-26-0x0000000000410000-0x0000000000477000-memory.dmp

Filesize
412KB

Download
memory/1760-28-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download