79345ef232cf306a40165d9e5f613a98f8a69dd565fe362509bdd514d5c4b8c2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:32

Target

2d6b5f2cc3d7506633c37f1948aac97b.exe
Size

66KB
MD5

2d6b5f2cc3d7506633c37f1948aac97b
SHA1

ebbc5d2aaee84e9abf323b1c0c70c3754989435e
SHA256

79345ef232cf306a40165d9e5f613a98f8a69dd565fe362509bdd514d5c4b8c2
SHA512

e51f6dbac833f6668c82227d297557de20cc1550d49729fd552209fa867b12fa2231d32a91313e99798f8b451c023a39457a16e8ea7dce0d857c95145ffd6f7f
SSDEEP

1536:MYC43ycpIXPCPoIewdsFBKnvgCYVB3YUA97ts1E7yyGh:JCxXP6oIewmrKnvgCYbXAx/7yBh

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2584 set thread context of 1304	2584	2d6b5f2cc3d7506633c37f1948aac97b.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2584	2d6b5f2cc3d7506633c37f1948aac97b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 1304	2584	2d6b5f2cc3d7506633c37f1948aac97b.exe	28
PID 2584 wrote to memory of 1304	2584	2d6b5f2cc3d7506633c37f1948aac97b.exe	28
PID 2584 wrote to memory of 1304	2584	2d6b5f2cc3d7506633c37f1948aac97b.exe	28
PID 2584 wrote to memory of 1304	2584	2d6b5f2cc3d7506633c37f1948aac97b.exe	28
PID 2584 wrote to memory of 1304	2584	2d6b5f2cc3d7506633c37f1948aac97b.exe	28
PID 2584 wrote to memory of 1304	2584	2d6b5f2cc3d7506633c37f1948aac97b.exe	28
PID 2584 wrote to memory of 1304	2584	2d6b5f2cc3d7506633c37f1948aac97b.exe	28
PID 2584 wrote to memory of 1304	2584	2d6b5f2cc3d7506633c37f1948aac97b.exe	28

C:\Users\Admin\AppData\Local\Temp\2d6b5f2cc3d7506633c37f1948aac97b.exe
"C:\Users\Admin\AppData\Local\Temp\2d6b5f2cc3d7506633c37f1948aac97b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\2d6b5f2cc3d7506633c37f1948aac97b.exe
  C:\Users\Admin\AppData\Local\Temp\2d6b5f2cc3d7506633c37f1948aac97b.exe
  2⤵
  PID:1304

memory/1304-2-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1304-3-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1304-5-0x0000000000400000-0x0000000000401800-memory.dmp

Filesize
6KB

Download