ddd13d218386496265571a556752f1ce401b8a14953fbda5a69f59d472cd55a2

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:44

Target

05df72623d2b5dce659505a30167c50b.exe
Size

276KB
MD5

05df72623d2b5dce659505a30167c50b
SHA1

4677a2152ed1c78a9ac1242712feb837bc809ef9
SHA256

ddd13d218386496265571a556752f1ce401b8a14953fbda5a69f59d472cd55a2
SHA512

1b4da3f0cc7c1d29067c8bb1c7aa951d2e2bc4a5b53eceeb4fc7eafbf9f6044dec7dc13ca5361be9c2984fe305b93fef279f2a45d7a404611cc2a94c4d8449c9
SSDEEP

1536:goR34MJ249icel/Z01/NBX4UDpegM3zwACUJGLq42GrElP2T/1oHolAu1Tqn1KSr:gSX0e1FB/DpKjCLHDC1Ks8z3+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2816 set thread context of 2824	2816	05df72623d2b5dce659505a30167c50b.exe	17

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2816	05df72623d2b5dce659505a30167c50b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2824	2816	05df72623d2b5dce659505a30167c50b.exe	17
PID 2816 wrote to memory of 2824	2816	05df72623d2b5dce659505a30167c50b.exe	17
PID 2816 wrote to memory of 2824	2816	05df72623d2b5dce659505a30167c50b.exe	17
PID 2816 wrote to memory of 2824	2816	05df72623d2b5dce659505a30167c50b.exe	17
PID 2816 wrote to memory of 2824	2816	05df72623d2b5dce659505a30167c50b.exe	17
PID 2816 wrote to memory of 2824	2816	05df72623d2b5dce659505a30167c50b.exe	17
PID 2816 wrote to memory of 2824	2816	05df72623d2b5dce659505a30167c50b.exe	17
PID 2816 wrote to memory of 2824	2816	05df72623d2b5dce659505a30167c50b.exe	17

C:\Users\Admin\AppData\Local\Temp\05df72623d2b5dce659505a30167c50b.exe
"C:\Users\Admin\AppData\Local\Temp\05df72623d2b5dce659505a30167c50b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\05df72623d2b5dce659505a30167c50b.exe
  "C:\Users\Admin\AppData\Local\Temp\05df72623d2b5dce659505a30167c50b.exe"
  2⤵
  PID:2824

memory/2824-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2824-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2824-5-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2824-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2824-9-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download