70ebd2f3374e9fb2391466117af4a2455edeb18bc1bff76593e88338a9941def

Analysis

max time kernel
122s
max time network
165s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:15

Target

073c937f63d1ae090eb63e03f64211c6.exe
Size

732KB
MD5

073c937f63d1ae090eb63e03f64211c6
SHA1

d1825b4dc222581344c973581fe26b148bad5c54
SHA256

70ebd2f3374e9fb2391466117af4a2455edeb18bc1bff76593e88338a9941def
SHA512

69a7021798bbf1aa1d48f760e0dc8827bba9b7f7ee52042b21c01c5a36f4606439ed892df8b86a57f48aee025afa0b8ed6c94d83ede5d45a4017d64190b2a3fb
SSDEEP

3072:hj3TNoSqNX5JDYYkuMoLcmBC7ewBVJEFyMR9HtS/BMrmTNk6JMtA6Vfa6UgsVZ96:heS16kQlfO+yPw0tDGiZ8EkkBp5+p

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2552 set thread context of 2492	2552	073c937f63d1ae090eb63e03f64211c6.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2492	073c937f63d1ae090eb63e03f64211c6.exe
2492	073c937f63d1ae090eb63e03f64211c6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2552	073c937f63d1ae090eb63e03f64211c6.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2492	2552	073c937f63d1ae090eb63e03f64211c6.exe	28
PID 2552 wrote to memory of 2492	2552	073c937f63d1ae090eb63e03f64211c6.exe	28
PID 2552 wrote to memory of 2492	2552	073c937f63d1ae090eb63e03f64211c6.exe	28
PID 2552 wrote to memory of 2492	2552	073c937f63d1ae090eb63e03f64211c6.exe	28
PID 2552 wrote to memory of 2492	2552	073c937f63d1ae090eb63e03f64211c6.exe	28
PID 2552 wrote to memory of 2492	2552	073c937f63d1ae090eb63e03f64211c6.exe	28
PID 2552 wrote to memory of 2492	2552	073c937f63d1ae090eb63e03f64211c6.exe	28
PID 2552 wrote to memory of 2492	2552	073c937f63d1ae090eb63e03f64211c6.exe	28
PID 2492 wrote to memory of 1244	2492	073c937f63d1ae090eb63e03f64211c6.exe	15
PID 2492 wrote to memory of 1244	2492	073c937f63d1ae090eb63e03f64211c6.exe	15
PID 2492 wrote to memory of 1244	2492	073c937f63d1ae090eb63e03f64211c6.exe	15
PID 2492 wrote to memory of 1244	2492	073c937f63d1ae090eb63e03f64211c6.exe	15

memory/1244-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1244-13-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2492-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2492-3-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2492-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2492-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2492-7-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2492-8-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2492-24-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download