6a2dca9df0b70f83a83e0890b9f595b95ac76e8694a226bd306d93149bf10309

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:37

Target

1eefdbd045ed1625334614a954e3c1f3.exe
Size

246KB
MD5

1eefdbd045ed1625334614a954e3c1f3
SHA1

0d9050f091d2391d471798dfbed166ac9bc30069
SHA256

6a2dca9df0b70f83a83e0890b9f595b95ac76e8694a226bd306d93149bf10309
SHA512

a1ee342bf1450f3cf0ca138cc53c09b9284f038f42baeeb00778fb9ab565609f0d974721c333f2e72264628f26248f5291488b407e87750b3a78594274545a2a
SSDEEP

6144:5hlnifryY4ga9eAOC5k96yAIK7OiDXcRY:5TnifrxOAqc/sc6

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2992 set thread context of 2484	2992	1eefdbd045ed1625334614a954e3c1f3.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2484	1eefdbd045ed1625334614a954e3c1f3.exe
2484	1eefdbd045ed1625334614a954e3c1f3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2992	1eefdbd045ed1625334614a954e3c1f3.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2484	2992	1eefdbd045ed1625334614a954e3c1f3.exe	28
PID 2992 wrote to memory of 2484	2992	1eefdbd045ed1625334614a954e3c1f3.exe	28
PID 2992 wrote to memory of 2484	2992	1eefdbd045ed1625334614a954e3c1f3.exe	28
PID 2992 wrote to memory of 2484	2992	1eefdbd045ed1625334614a954e3c1f3.exe	28
PID 2992 wrote to memory of 2484	2992	1eefdbd045ed1625334614a954e3c1f3.exe	28
PID 2992 wrote to memory of 2484	2992	1eefdbd045ed1625334614a954e3c1f3.exe	28
PID 2992 wrote to memory of 2484	2992	1eefdbd045ed1625334614a954e3c1f3.exe	28
PID 2992 wrote to memory of 2484	2992	1eefdbd045ed1625334614a954e3c1f3.exe	28
PID 2484 wrote to memory of 1272	2484	1eefdbd045ed1625334614a954e3c1f3.exe	12
PID 2484 wrote to memory of 1272	2484	1eefdbd045ed1625334614a954e3c1f3.exe	12
PID 2484 wrote to memory of 1272	2484	1eefdbd045ed1625334614a954e3c1f3.exe	12
PID 2484 wrote to memory of 1272	2484	1eefdbd045ed1625334614a954e3c1f3.exe	12

memory/1272-11-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1272-14-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2484-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2484-7-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2484-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2484-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2484-10-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2484-23-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2484-24-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2992-0-0x0000000000400000-0x000000000049A150-memory.dmp

Filesize
616KB

Download
memory/2992-5-0x00000000026E0000-0x000000000277B000-memory.dmp

Filesize
620KB

Download
memory/2992-9-0x0000000000400000-0x000000000049A150-memory.dmp

Filesize
616KB

Download