1536761a000352b134f9ae15e8749bead0fb37def08d40a9734189e96ae991b1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:13

Target

3a92a80c7288fdfaf093a4ad3defbdbd.exe
Size

607KB
MD5

3a92a80c7288fdfaf093a4ad3defbdbd
SHA1

686cc74e1e2726f0a0463d434da388530637a824
SHA256

1536761a000352b134f9ae15e8749bead0fb37def08d40a9734189e96ae991b1
SHA512

bcfda05fd2b5271d6b7ebcfe08b4e724fdb28480288e80943194187c3e8af9bf2330f6e0da43e8f1f7eba679be49dfa44336a462fbeee1ca588dc779d580ff76
SSDEEP

12288:lnfOx4gSwGoMXp8AAVI2nZmlRgvZXqyd8ByymZB8xQIusk6O4M:lnEnkZ8r3nZaRgv8BLuBwPuskn

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1936	2032	3a92a80c7288fdfaf093a4ad3defbdbd.exe	28
PID 2032 wrote to memory of 1936	2032	3a92a80c7288fdfaf093a4ad3defbdbd.exe	28
PID 2032 wrote to memory of 1936	2032	3a92a80c7288fdfaf093a4ad3defbdbd.exe	28
PID 2032 wrote to memory of 1936	2032	3a92a80c7288fdfaf093a4ad3defbdbd.exe	28
PID 2032 wrote to memory of 1172	2032	3a92a80c7288fdfaf093a4ad3defbdbd.exe	29
PID 2032 wrote to memory of 1172	2032	3a92a80c7288fdfaf093a4ad3defbdbd.exe	29
PID 2032 wrote to memory of 1172	2032	3a92a80c7288fdfaf093a4ad3defbdbd.exe	29
PID 2032 wrote to memory of 1172	2032	3a92a80c7288fdfaf093a4ad3defbdbd.exe	29

C:\Users\Admin\AppData\Local\Temp\3a92a80c7288fdfaf093a4ad3defbdbd.exe
"C:\Users\Admin\AppData\Local\Temp\3a92a80c7288fdfaf093a4ad3defbdbd.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\3a92a80c7288fdfaf093a4ad3defbdbd.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1936
- C:\Users\Admin\AppData\Local\Temp\3a92a80c7288fdfaf093a4ad3defbdbd.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1172

memory/1172-6-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1172-9-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1172-11-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1936-5-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1936-7-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1936-8-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1936-10-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2032-0-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2032-2-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2032-1-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2032-4-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2032-12-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download