7df4cb13d151b1df71e883fa9cfa45e52905175874a29584495767fcbdd0ff79

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:15

Target

33c214cf70d009a971607df3cc5c0663.exe
Size

434KB
MD5

33c214cf70d009a971607df3cc5c0663
SHA1

167e55aa039c9430ca1f1e40a79b91709080ae27
SHA256

7df4cb13d151b1df71e883fa9cfa45e52905175874a29584495767fcbdd0ff79
SHA512

486be07e1c77f28cd08f03ec5a484f3415e335c66da2733937145b0d8bad59c362e1ece4909224c414e67d12009c9c5612c017bdf9048e1087e7d7446a5aafa6
SSDEEP

6144:kHO+mKNdd0VJpo1WAJxTyr7htKF8qGXlwH5d0QxVDnvIk0t/xq14p33+ft5bei01:QOiL8JI9KT08qGAYwVLX0/mY33+ly3

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2784 set thread context of 2932	2784	33c214cf70d009a971607df3cc5c0663.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2784	33c214cf70d009a971607df3cc5c0663.exe
2784	33c214cf70d009a971607df3cc5c0663.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2932	2784	33c214cf70d009a971607df3cc5c0663.exe	28
PID 2784 wrote to memory of 2932	2784	33c214cf70d009a971607df3cc5c0663.exe	28
PID 2784 wrote to memory of 2932	2784	33c214cf70d009a971607df3cc5c0663.exe	28
PID 2784 wrote to memory of 2932	2784	33c214cf70d009a971607df3cc5c0663.exe	28
PID 2784 wrote to memory of 2932	2784	33c214cf70d009a971607df3cc5c0663.exe	28
PID 2784 wrote to memory of 2932	2784	33c214cf70d009a971607df3cc5c0663.exe	28
PID 2784 wrote to memory of 2932	2784	33c214cf70d009a971607df3cc5c0663.exe	28
PID 2784 wrote to memory of 2932	2784	33c214cf70d009a971607df3cc5c0663.exe	28
PID 2784 wrote to memory of 2932	2784	33c214cf70d009a971607df3cc5c0663.exe	28
PID 2784 wrote to memory of 2932	2784	33c214cf70d009a971607df3cc5c0663.exe	28

C:\Users\Admin\AppData\Local\Temp\33c214cf70d009a971607df3cc5c0663.exe
"C:\Users\Admin\AppData\Local\Temp\33c214cf70d009a971607df3cc5c0663.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Users\Admin\AppData\Local\Temp\33c214cf70d009a971607df3cc5c0663.exe
  C:\Users\Admin\AppData\Local\Temp\33c214cf70d009a971607df3cc5c0663.exe
  2⤵
  PID:2932

memory/2784-17-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2932-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2932-16-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2932-15-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2932-14-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2932-11-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2932-2-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2932-8-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2932-7-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2932-6-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2932-4-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2932-13-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2932-18-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2932-20-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download