cb6f729631590883ee1950b6b5296ca6261b64ef2b35e68481b229b3a7eea78d

Analysis

max time kernel
120s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 19:45

Target

39070e7fc3ce65f4fe757596af4c1778.exe
Size

55KB
MD5

39070e7fc3ce65f4fe757596af4c1778
SHA1

3014e211f5917f7436587eb07fd5dd015b713633
SHA256

cb6f729631590883ee1950b6b5296ca6261b64ef2b35e68481b229b3a7eea78d
SHA512

1fa05d5885e09282d442cc3c17d34f8070744deca4d9337bc2e391b0833f66ea77d38f146229d1d1745b2ae480d50b42642ad70c2dd0e496b126ab7425176915
SSDEEP

768:0nzj3Ypmt9rb/s/JLFOU9juSxyOF4sMXHerGCEEzGzWAbRl15Aoj9JM:czjIpErzmJgU9jziBCnKlL76

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1016 set thread context of 2508	1016	39070e7fc3ce65f4fe757596af4c1778.exe	25

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2508	39070e7fc3ce65f4fe757596af4c1778.exe
2508	39070e7fc3ce65f4fe757596af4c1778.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1016	39070e7fc3ce65f4fe757596af4c1778.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 2508	1016	39070e7fc3ce65f4fe757596af4c1778.exe	25
PID 1016 wrote to memory of 2508	1016	39070e7fc3ce65f4fe757596af4c1778.exe	25
PID 1016 wrote to memory of 2508	1016	39070e7fc3ce65f4fe757596af4c1778.exe	25
PID 1016 wrote to memory of 2508	1016	39070e7fc3ce65f4fe757596af4c1778.exe	25
PID 1016 wrote to memory of 2508	1016	39070e7fc3ce65f4fe757596af4c1778.exe	25
PID 1016 wrote to memory of 2508	1016	39070e7fc3ce65f4fe757596af4c1778.exe	25
PID 1016 wrote to memory of 2508	1016	39070e7fc3ce65f4fe757596af4c1778.exe	25
PID 1016 wrote to memory of 2508	1016	39070e7fc3ce65f4fe757596af4c1778.exe	25
PID 2508 wrote to memory of 1204	2508	39070e7fc3ce65f4fe757596af4c1778.exe	8
PID 2508 wrote to memory of 1204	2508	39070e7fc3ce65f4fe757596af4c1778.exe	8
PID 2508 wrote to memory of 1204	2508	39070e7fc3ce65f4fe757596af4c1778.exe	8
PID 2508 wrote to memory of 1204	2508	39070e7fc3ce65f4fe757596af4c1778.exe	8

memory/1204-15-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1204-18-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2508-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2508-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2508-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2508-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2508-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2508-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2508-14-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2508-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2508-10-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2508-28-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2508-29-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download