e97775ea4c43a1596b729b84801495724adf63eb2e4f294377ac47283fcaa8be

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:12

Target

022e6e5549d9055d1437b44473c4cc38.exe
Size

188KB
MD5

022e6e5549d9055d1437b44473c4cc38
SHA1

825bde7a3340a0f7813ba710cee3c83d281bac10
SHA256

e97775ea4c43a1596b729b84801495724adf63eb2e4f294377ac47283fcaa8be
SHA512

a754bdfa483a947a4504ed4dfa55cd0277df323fc0e121c97cba0495846134d191aac1f2f8b8a722f2696fd257a52590ad57b234d7012c375efa6882ac5607b5
SSDEEP

3072:HqMUPS9+6jU0grrp46Cdp9cGI5T1hK2wcUZU:KqXpE8i

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 2100	1620	022e6e5549d9055d1437b44473c4cc38.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2100	022e6e5549d9055d1437b44473c4cc38.EXE
2100	022e6e5549d9055d1437b44473c4cc38.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1620	022e6e5549d9055d1437b44473c4cc38.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2100	1620	022e6e5549d9055d1437b44473c4cc38.exe	28
PID 1620 wrote to memory of 2100	1620	022e6e5549d9055d1437b44473c4cc38.exe	28
PID 1620 wrote to memory of 2100	1620	022e6e5549d9055d1437b44473c4cc38.exe	28
PID 1620 wrote to memory of 2100	1620	022e6e5549d9055d1437b44473c4cc38.exe	28
PID 1620 wrote to memory of 2100	1620	022e6e5549d9055d1437b44473c4cc38.exe	28
PID 1620 wrote to memory of 2100	1620	022e6e5549d9055d1437b44473c4cc38.exe	28
PID 1620 wrote to memory of 2100	1620	022e6e5549d9055d1437b44473c4cc38.exe	28
PID 1620 wrote to memory of 2100	1620	022e6e5549d9055d1437b44473c4cc38.exe	28
PID 2100 wrote to memory of 1220	2100	022e6e5549d9055d1437b44473c4cc38.EXE	11
PID 2100 wrote to memory of 1220	2100	022e6e5549d9055d1437b44473c4cc38.EXE	11
PID 2100 wrote to memory of 1220	2100	022e6e5549d9055d1437b44473c4cc38.EXE	11
PID 2100 wrote to memory of 1220	2100	022e6e5549d9055d1437b44473c4cc38.EXE	11

memory/1220-11-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1220-7-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2100-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2100-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2100-4-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2100-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2100-10-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2100-21-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download