226ce544a88c9114ce0a239706f5f56740cefdbbe7ab1588019ec695c890385d

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:57

Target

39ae4f7ace727712daf6a593f5ad4ab5.exe
Size

608KB
MD5

39ae4f7ace727712daf6a593f5ad4ab5
SHA1

e3bb544c84d062e18525e1b4350e247d888b80b0
SHA256

226ce544a88c9114ce0a239706f5f56740cefdbbe7ab1588019ec695c890385d
SHA512

148867412f9900db1a93d5d5618b4b4985950fccab09f821148e79e2b3ee2873468088573612e7a67e92f3ccb4ce98ceb59bd2b6878c36f4d94d018cd542a748
SSDEEP

12288:NuMV+HYuCmEUQQpKe5d05nBXYcfA/LcEl+GM:MU+HRvQze5dmnBIcfcW

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1148	1384	39ae4f7ace727712daf6a593f5ad4ab5.exe	17
PID 1384 wrote to memory of 1148	1384	39ae4f7ace727712daf6a593f5ad4ab5.exe	17
PID 1384 wrote to memory of 1148	1384	39ae4f7ace727712daf6a593f5ad4ab5.exe	17
PID 1384 wrote to memory of 1148	1384	39ae4f7ace727712daf6a593f5ad4ab5.exe	17
PID 1384 wrote to memory of 2996	1384	39ae4f7ace727712daf6a593f5ad4ab5.exe	16
PID 1384 wrote to memory of 2996	1384	39ae4f7ace727712daf6a593f5ad4ab5.exe	16
PID 1384 wrote to memory of 2996	1384	39ae4f7ace727712daf6a593f5ad4ab5.exe	16
PID 1384 wrote to memory of 2996	1384	39ae4f7ace727712daf6a593f5ad4ab5.exe	16

C:\Users\Admin\AppData\Local\Temp\39ae4f7ace727712daf6a593f5ad4ab5.exe
"C:\Users\Admin\AppData\Local\Temp\39ae4f7ace727712daf6a593f5ad4ab5.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Temp\39ae4f7ace727712daf6a593f5ad4ab5.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2996
- C:\Users\Admin\AppData\Local\Temp\39ae4f7ace727712daf6a593f5ad4ab5.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1148

memory/1148-8-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1148-11-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1148-9-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1384-4-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1384-5-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1384-6-0x00000000021F0000-0x000000000228D000-memory.dmp

Filesize
628KB

Download
memory/1384-3-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1384-2-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1384-1-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1384-0-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2996-7-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2996-12-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2996-10-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download