512f027333f57cd2d11d3fe792c7b8537b1037b5916ed5e75bf63cc18d6bd6c6

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:12

Target

338e75e8b98157e77abe9278a4ee182e.exe
Size

195KB
MD5

338e75e8b98157e77abe9278a4ee182e
SHA1

bb40aad5e264601b74b5b65efefa23c2712d97a7
SHA256

512f027333f57cd2d11d3fe792c7b8537b1037b5916ed5e75bf63cc18d6bd6c6
SHA512

e10d8cda6f56bfbd75c3ebb217cc0bee4a768fceabc2e2cca3f87f7f34819abd61ad525d4cd78a887910eb0378269093b63ea77dd659b1eccaa31e186837b507
SSDEEP

3072:UxsgiukdSZJEpJnohdEJ1MtAe7gn17/C7f0WNCHeODTIOKOvQc2v7+O0RBl:Osgil8egEJzqbh4jXj07+dLl

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3044 set thread context of 1360	3044	338e75e8b98157e77abe9278a4ee182e.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1360	338e75e8b98157e77abe9278a4ee182e.exe
1360	338e75e8b98157e77abe9278a4ee182e.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1360	3044	338e75e8b98157e77abe9278a4ee182e.exe	28
PID 3044 wrote to memory of 1360	3044	338e75e8b98157e77abe9278a4ee182e.exe	28
PID 3044 wrote to memory of 1360	3044	338e75e8b98157e77abe9278a4ee182e.exe	28
PID 3044 wrote to memory of 1360	3044	338e75e8b98157e77abe9278a4ee182e.exe	28
PID 3044 wrote to memory of 1360	3044	338e75e8b98157e77abe9278a4ee182e.exe	28
PID 3044 wrote to memory of 1360	3044	338e75e8b98157e77abe9278a4ee182e.exe	28
PID 1360 wrote to memory of 1252	1360	338e75e8b98157e77abe9278a4ee182e.exe	10
PID 1360 wrote to memory of 1252	1360	338e75e8b98157e77abe9278a4ee182e.exe	10
PID 1360 wrote to memory of 1252	1360	338e75e8b98157e77abe9278a4ee182e.exe	10
PID 1360 wrote to memory of 1252	1360	338e75e8b98157e77abe9278a4ee182e.exe	10

memory/1252-13-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1252-9-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1360-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1360-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1360-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1360-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1360-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1360-12-0x0000000000240000-0x0000000000253000-memory.dmp

Filesize
76KB

Download
memory/3044-4-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download