1268780bd4d4e27f57c90a494a97660c31ef85e12054632e45bea9b4a915ff12

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:26

Target

3b34b8222e2f367795e5c64459bb6414.exe
Size

602KB
MD5

3b34b8222e2f367795e5c64459bb6414
SHA1

ebba945d69c94aac61771eddbcd422fc64025e3b
SHA256

1268780bd4d4e27f57c90a494a97660c31ef85e12054632e45bea9b4a915ff12
SHA512

6b3c11360c7edbca280ab7b7848b975631893e2d963dec2627c7fe6571e169c3c809f855676cb454426f64c5205eed1ce524f1090c924cac1b28f434771dfb32
SSDEEP

12288:cU0/GFk2qgwSp31LXgRDK6niecVEIlsMbhOB8Rc7KRFMD:Al2qs4n1wHKQhPi

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3068	3000	3b34b8222e2f367795e5c64459bb6414.exe	28
PID 3000 wrote to memory of 3068	3000	3b34b8222e2f367795e5c64459bb6414.exe	28
PID 3000 wrote to memory of 3068	3000	3b34b8222e2f367795e5c64459bb6414.exe	28
PID 3000 wrote to memory of 3068	3000	3b34b8222e2f367795e5c64459bb6414.exe	28
PID 3000 wrote to memory of 2076	3000	3b34b8222e2f367795e5c64459bb6414.exe	29
PID 3000 wrote to memory of 2076	3000	3b34b8222e2f367795e5c64459bb6414.exe	29
PID 3000 wrote to memory of 2076	3000	3b34b8222e2f367795e5c64459bb6414.exe	29
PID 3000 wrote to memory of 2076	3000	3b34b8222e2f367795e5c64459bb6414.exe	29

C:\Users\Admin\AppData\Local\Temp\3b34b8222e2f367795e5c64459bb6414.exe
"C:\Users\Admin\AppData\Local\Temp\3b34b8222e2f367795e5c64459bb6414.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\3b34b8222e2f367795e5c64459bb6414.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3068
- C:\Users\Admin\AppData\Local\Temp\3b34b8222e2f367795e5c64459bb6414.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2076

memory/2076-10-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2076-12-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2076-8-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3000-1-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3000-2-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/3000-3-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3000-5-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3000-0-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3000-4-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/3068-6-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3068-9-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3068-11-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3068-7-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download