ac5f0098b9a8fb766459939fb1c32e4b6cdae80bce6646ef80bc1af87152069c

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:39

Target

67f2ae85c594fae4c085775569008936.exe
Size

38KB
MD5

67f2ae85c594fae4c085775569008936
SHA1

3f0bfe90786946f04a776726eabff918b8efc880
SHA256

ac5f0098b9a8fb766459939fb1c32e4b6cdae80bce6646ef80bc1af87152069c
SHA512

8772761675b952a992a107ef90248762ab522f977edc062a67b4bf743e0c33e7f8d57d46825568a3b5eee11d93f31abb35855d3242c48404e844792618fc033c
SSDEEP

768:EshyiFXd7r8VsZcJbOsvmYwPvvxOsRVBmyK:EU7vOsmbOsv43vxFRTmp

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2164 set thread context of 3020	2164	67f2ae85c594fae4c085775569008936.exe	17

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3020	67f2ae85c594fae4c085775569008936.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3020	67f2ae85c594fae4c085775569008936.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2164	67f2ae85c594fae4c085775569008936.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 3020	2164	67f2ae85c594fae4c085775569008936.exe	17
PID 2164 wrote to memory of 3020	2164	67f2ae85c594fae4c085775569008936.exe	17
PID 2164 wrote to memory of 3020	2164	67f2ae85c594fae4c085775569008936.exe	17
PID 2164 wrote to memory of 3020	2164	67f2ae85c594fae4c085775569008936.exe	17
PID 2164 wrote to memory of 3020	2164	67f2ae85c594fae4c085775569008936.exe	17
PID 2164 wrote to memory of 3020	2164	67f2ae85c594fae4c085775569008936.exe	17
PID 2164 wrote to memory of 3020	2164	67f2ae85c594fae4c085775569008936.exe	17
PID 2164 wrote to memory of 3020	2164	67f2ae85c594fae4c085775569008936.exe	17
PID 3020 wrote to memory of 1328	3020	67f2ae85c594fae4c085775569008936.exe	8
PID 3020 wrote to memory of 1328	3020	67f2ae85c594fae4c085775569008936.exe	8
PID 3020 wrote to memory of 1328	3020	67f2ae85c594fae4c085775569008936.exe	8
PID 3020 wrote to memory of 1328	3020	67f2ae85c594fae4c085775569008936.exe	8
PID 3020 wrote to memory of 1328	3020	67f2ae85c594fae4c085775569008936.exe	8
PID 3020 wrote to memory of 1328	3020	67f2ae85c594fae4c085775569008936.exe	8
PID 3020 wrote to memory of 1328	3020	67f2ae85c594fae4c085775569008936.exe	8
PID 3020 wrote to memory of 1328	3020	67f2ae85c594fae4c085775569008936.exe	8
PID 3020 wrote to memory of 1328	3020	67f2ae85c594fae4c085775569008936.exe	8
PID 3020 wrote to memory of 1328	3020	67f2ae85c594fae4c085775569008936.exe	8
PID 3020 wrote to memory of 1328	3020	67f2ae85c594fae4c085775569008936.exe	8

memory/1328-17-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

Filesize
4KB

Download
memory/1328-7-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/2164-4-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3020-19-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3020-6-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3020-5-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3020-2-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download