7df095b6a5166d06a3e623061d8568c7fbd4ee6d3ae110d258f22333cad8890d

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 12:58

Target

7060f76cdc55ba6d7e3c7f09c2528261.exe
Size

140KB
MD5

7060f76cdc55ba6d7e3c7f09c2528261
SHA1

0e8f2ca1d6f26d487a0d06bb8409cf24b2632e87
SHA256

7df095b6a5166d06a3e623061d8568c7fbd4ee6d3ae110d258f22333cad8890d
SHA512

e1bf5b34f8eb655862215912da7f80a6d4ccae9e59da64b9ef8a482e43c8dab9c62bb5b37f8a31ab03d20c689fc492784e323b80c33a16a518f6a525b5b64415
SSDEEP

1536:wOeK6TgIo4QNjGG5cidjg1yerGLrLd9iRsBdLLdCw4bn3Q0hIKn9oMmcXaHrz0Cu:sKkQNjGYaJ9odcqv1fP/F2nUod

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2348 set thread context of 2428	2348	7060f76cdc55ba6d7e3c7f09c2528261.exe	21

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2348	7060f76cdc55ba6d7e3c7f09c2528261.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2428	2348	7060f76cdc55ba6d7e3c7f09c2528261.exe	21
PID 2348 wrote to memory of 2428	2348	7060f76cdc55ba6d7e3c7f09c2528261.exe	21
PID 2348 wrote to memory of 2428	2348	7060f76cdc55ba6d7e3c7f09c2528261.exe	21
PID 2348 wrote to memory of 2428	2348	7060f76cdc55ba6d7e3c7f09c2528261.exe	21
PID 2348 wrote to memory of 2428	2348	7060f76cdc55ba6d7e3c7f09c2528261.exe	21
PID 2348 wrote to memory of 2428	2348	7060f76cdc55ba6d7e3c7f09c2528261.exe	21
PID 2348 wrote to memory of 2428	2348	7060f76cdc55ba6d7e3c7f09c2528261.exe	21
PID 2428 wrote to memory of 3488	2428	7060f76cdc55ba6d7e3c7f09c2528261.exe	50
PID 2428 wrote to memory of 3488	2428	7060f76cdc55ba6d7e3c7f09c2528261.exe	50
PID 2428 wrote to memory of 3488	2428	7060f76cdc55ba6d7e3c7f09c2528261.exe	50
PID 2428 wrote to memory of 3488	2428	7060f76cdc55ba6d7e3c7f09c2528261.exe	50

C:\Users\Admin\AppData\Local\Temp\7060f76cdc55ba6d7e3c7f09c2528261.exe
"C:\Users\Admin\AppData\Local\Temp\7060f76cdc55ba6d7e3c7f09c2528261.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\7060f76cdc55ba6d7e3c7f09c2528261.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2428

memory/2428-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2428-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2428-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2428-6-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2428-13-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2428-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3488-7-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3488-8-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download