36eba96eae574c513c1a661f6debd7da3864c49938cb7c96e4a83459c1230244

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:50

Target

1c0fe3ed35e4cb04e14b453e7754c31d.exe
Size

57KB
MD5

1c0fe3ed35e4cb04e14b453e7754c31d
SHA1

a1174cd57a51a3ca9e40db7ecbcbfe9c93a06cca
SHA256

36eba96eae574c513c1a661f6debd7da3864c49938cb7c96e4a83459c1230244
SHA512

1661c7b3a0f7a21497f7f16b6775e6ba89012867bb4fc53c9fd03e86f75c9c036eec61f87b5b347c72799e9a7cbcc84b8cc55cf334892e3716b67f28d421846e
SSDEEP

1536:tF7UNxEOYG5rXLzsV9PBY4OQAkZngjAoJDqlBu73NxfMY:X+xEOYG5rXfsVvYNQAkJgjAoJDqlBQ3P

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2732 set thread context of 2172	2732	1c0fe3ed35e4cb04e14b453e7754c31d.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2732	1c0fe3ed35e4cb04e14b453e7754c31d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2172	2732	1c0fe3ed35e4cb04e14b453e7754c31d.exe	28
PID 2732 wrote to memory of 2172	2732	1c0fe3ed35e4cb04e14b453e7754c31d.exe	28
PID 2732 wrote to memory of 2172	2732	1c0fe3ed35e4cb04e14b453e7754c31d.exe	28
PID 2732 wrote to memory of 2172	2732	1c0fe3ed35e4cb04e14b453e7754c31d.exe	28
PID 2732 wrote to memory of 2172	2732	1c0fe3ed35e4cb04e14b453e7754c31d.exe	28
PID 2732 wrote to memory of 2172	2732	1c0fe3ed35e4cb04e14b453e7754c31d.exe	28
PID 2732 wrote to memory of 2172	2732	1c0fe3ed35e4cb04e14b453e7754c31d.exe	28
PID 2732 wrote to memory of 2172	2732	1c0fe3ed35e4cb04e14b453e7754c31d.exe	28

C:\Users\Admin\AppData\Local\Temp\1c0fe3ed35e4cb04e14b453e7754c31d.exe
"C:\Users\Admin\AppData\Local\Temp\1c0fe3ed35e4cb04e14b453e7754c31d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\1c0fe3ed35e4cb04e14b453e7754c31d.exe
  "C:\Users\Admin\AppData\Local\Temp\1c0fe3ed35e4cb04e14b453e7754c31d.exe"
  2⤵
  PID:2172

memory/2172-16-0x0000000000400000-0x0000000000402600-memory.dmp

Filesize
9KB

Download
memory/2172-14-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2172-13-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2172-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2172-9-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2172-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2172-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2732-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2732-17-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download