e0750dc16b5f93ba2f7f05dd6bb51a63ba8500c971cfd60b9d778db1d5a94ac5

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:59

Target

5b2145400fe9b11dd1048e4ba2f3bc8f.exe
Size

208KB
MD5

5b2145400fe9b11dd1048e4ba2f3bc8f
SHA1

f98a1da272c368fb1e0f467ba624064600c23253
SHA256

e0750dc16b5f93ba2f7f05dd6bb51a63ba8500c971cfd60b9d778db1d5a94ac5
SHA512

02ab94ce1ddb34aa3ed4220302171d1b57e45046af19058644fd4e26e9e70d3ef5fc10eeb10fc110f6bac252447cac8b228f16d81828a0c8088fc488bcedb3c0
SSDEEP

3072:w/Y+7IXdeOnVLyCGuVbh9sfp0Rip/j1B/Tuw8v/:67CtJh9sfp0gj1M/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1888 set thread context of 2628	1888	5b2145400fe9b11dd1048e4ba2f3bc8f.exe	17

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2628	5b2145400fe9b11dd1048e4ba2f3bc8f.exe
2628	5b2145400fe9b11dd1048e4ba2f3bc8f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1888	5b2145400fe9b11dd1048e4ba2f3bc8f.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2628	1888	5b2145400fe9b11dd1048e4ba2f3bc8f.exe	17
PID 1888 wrote to memory of 2628	1888	5b2145400fe9b11dd1048e4ba2f3bc8f.exe	17
PID 1888 wrote to memory of 2628	1888	5b2145400fe9b11dd1048e4ba2f3bc8f.exe	17
PID 1888 wrote to memory of 2628	1888	5b2145400fe9b11dd1048e4ba2f3bc8f.exe	17
PID 1888 wrote to memory of 2628	1888	5b2145400fe9b11dd1048e4ba2f3bc8f.exe	17
PID 1888 wrote to memory of 2628	1888	5b2145400fe9b11dd1048e4ba2f3bc8f.exe	17
PID 1888 wrote to memory of 2628	1888	5b2145400fe9b11dd1048e4ba2f3bc8f.exe	17
PID 1888 wrote to memory of 2628	1888	5b2145400fe9b11dd1048e4ba2f3bc8f.exe	17
PID 2628 wrote to memory of 1248	2628	5b2145400fe9b11dd1048e4ba2f3bc8f.exe	21
PID 2628 wrote to memory of 1248	2628	5b2145400fe9b11dd1048e4ba2f3bc8f.exe	21
PID 2628 wrote to memory of 1248	2628	5b2145400fe9b11dd1048e4ba2f3bc8f.exe	21
PID 2628 wrote to memory of 1248	2628	5b2145400fe9b11dd1048e4ba2f3bc8f.exe	21

memory/1248-9-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1248-12-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2628-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2628-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2628-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2628-3-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2628-7-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2628-23-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2628-22-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download