f11b599236882cd5c711b416384a00f573e0ffb1186e59c1a231731bf5339d9b

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 01:29

Target

4964bc5e5b2066b0e42b99c026fc6f24.exe
Size

148KB
MD5

4964bc5e5b2066b0e42b99c026fc6f24
SHA1

7040acdbfd2b3752992764cc72f7d02971b932a8
SHA256

f11b599236882cd5c711b416384a00f573e0ffb1186e59c1a231731bf5339d9b
SHA512

9df907f12003f8f85b54162f1a624a5ca2edda268cd4dddc6950099dff7c9e052ca7ddacb49425ddc676c0eaad99bbce992a6d0abb569a77fff0f03e4559b70f
SSDEEP

1536:7tWP41C/7tfteeRXoJ9zoWzH0sUzZhyFBndTX7EtWAfFE4G:7tX1C/7tfE+oJxo2HDkKFrmWAjG

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2448 set thread context of 2840	2448	4964bc5e5b2066b0e42b99c026fc6f24.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2448	4964bc5e5b2066b0e42b99c026fc6f24.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2840	2448	4964bc5e5b2066b0e42b99c026fc6f24.exe	28
PID 2448 wrote to memory of 2840	2448	4964bc5e5b2066b0e42b99c026fc6f24.exe	28
PID 2448 wrote to memory of 2840	2448	4964bc5e5b2066b0e42b99c026fc6f24.exe	28
PID 2448 wrote to memory of 2840	2448	4964bc5e5b2066b0e42b99c026fc6f24.exe	28
PID 2448 wrote to memory of 2840	2448	4964bc5e5b2066b0e42b99c026fc6f24.exe	28
PID 2448 wrote to memory of 2840	2448	4964bc5e5b2066b0e42b99c026fc6f24.exe	28
PID 2448 wrote to memory of 2840	2448	4964bc5e5b2066b0e42b99c026fc6f24.exe	28
PID 2448 wrote to memory of 2840	2448	4964bc5e5b2066b0e42b99c026fc6f24.exe	28

C:\Users\Admin\AppData\Local\Temp\4964bc5e5b2066b0e42b99c026fc6f24.exe
"C:\Users\Admin\AppData\Local\Temp\4964bc5e5b2066b0e42b99c026fc6f24.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\4964bc5e5b2066b0e42b99c026fc6f24.exe
  C:\Users\Admin\AppData\Local\Temp\\\\\\\4964bc5e5b2066b0e42b99c026fc6f24.exe
  2⤵
  PID:2840

memory/2840-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2840-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2840-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2840-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2840-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download