20d9e3fd9ab84238ca7d2399bef069530b88bde26c68c828551d72b531666db5

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 01:22

Target

48f49cd87025c76ca4d4ed34173633f2.exe
Size

606KB
MD5

48f49cd87025c76ca4d4ed34173633f2
SHA1

98b6fc6166191e946929ce880d15783bdd5c1c75
SHA256

20d9e3fd9ab84238ca7d2399bef069530b88bde26c68c828551d72b531666db5
SHA512

757b4b06031ab75e00622e1a315e590958147bf0f28fe941718af07f3283413a953c4a01daa7cfd7b4c986e96eed91983c219010c85f0134ba85a4e9a668638b
SSDEEP

12288:vJm5Pb6ZdEOHiI/GIf4m3u4uLEuC8SLneo6NjMX:Rc6QmGI/3u4VgSzZ6K

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1976	2292	48f49cd87025c76ca4d4ed34173633f2.exe	15
PID 2292 wrote to memory of 1976	2292	48f49cd87025c76ca4d4ed34173633f2.exe	15
PID 2292 wrote to memory of 1976	2292	48f49cd87025c76ca4d4ed34173633f2.exe	15
PID 2292 wrote to memory of 1976	2292	48f49cd87025c76ca4d4ed34173633f2.exe	15
PID 2292 wrote to memory of 3068	2292	48f49cd87025c76ca4d4ed34173633f2.exe	17
PID 2292 wrote to memory of 3068	2292	48f49cd87025c76ca4d4ed34173633f2.exe	17
PID 2292 wrote to memory of 3068	2292	48f49cd87025c76ca4d4ed34173633f2.exe	17
PID 2292 wrote to memory of 3068	2292	48f49cd87025c76ca4d4ed34173633f2.exe	17

C:\Users\Admin\AppData\Local\Temp\48f49cd87025c76ca4d4ed34173633f2.exe
start
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1976

C:\Users\Admin\AppData\Local\Temp\48f49cd87025c76ca4d4ed34173633f2.exe
watch
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3068

memory/1976-9-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1976-13-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1976-11-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1976-5-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1976-8-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2292-3-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2292-6-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2292-1-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2292-2-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2292-0-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2292-15-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3068-10-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3068-12-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3068-7-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3068-14-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download