6df9efb4c66d0ee6c2f2a2a238a324eb019905c07bb5874d94dc0a7c3117f022

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 02:42

Target

4d707df97628b07c710908226e234d88.exe
Size

68KB
MD5

4d707df97628b07c710908226e234d88
SHA1

042b306013e644a4341a90c337283d571436305a
SHA256

6df9efb4c66d0ee6c2f2a2a238a324eb019905c07bb5874d94dc0a7c3117f022
SHA512

a9c84ebcfb398ef664d199d68416983fde776a70333be5ca918b45c60c440310461f43be96853169b2922f7e99fa0978685ba58786cb032b27965a3c7fb3381b
SSDEEP

768:Vnk+chnndZQefxpeMwd1Jg5YRwWLBPJpXSKgLBPJpXj:5k+c1ndZQefYlg5KwWVBpXSKgVBpXj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2876 set thread context of 2408	2876	4d707df97628b07c710908226e234d88.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2876	4d707df97628b07c710908226e234d88.exe
2408	4d707df97628b07c710908226e234d88.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2408	2876	4d707df97628b07c710908226e234d88.exe	28
PID 2876 wrote to memory of 2408	2876	4d707df97628b07c710908226e234d88.exe	28
PID 2876 wrote to memory of 2408	2876	4d707df97628b07c710908226e234d88.exe	28
PID 2876 wrote to memory of 2408	2876	4d707df97628b07c710908226e234d88.exe	28
PID 2876 wrote to memory of 2408	2876	4d707df97628b07c710908226e234d88.exe	28
PID 2876 wrote to memory of 2408	2876	4d707df97628b07c710908226e234d88.exe	28
PID 2876 wrote to memory of 2408	2876	4d707df97628b07c710908226e234d88.exe	28
PID 2876 wrote to memory of 2408	2876	4d707df97628b07c710908226e234d88.exe	28
PID 2876 wrote to memory of 2408	2876	4d707df97628b07c710908226e234d88.exe	28

C:\Users\Admin\AppData\Local\Temp\4d707df97628b07c710908226e234d88.exe
"C:\Users\Admin\AppData\Local\Temp\4d707df97628b07c710908226e234d88.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\4d707df97628b07c710908226e234d88.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2408

memory/2408-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2408-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2408-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download