bd211ecbb120889ac6cee9b51bd8ca180e8cb19fe32c40cc3f734990b3ef9f9f

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-12-2023 14:43

Target

b39369b7ec82f688abfefa8040a9508a.exe
Size

38KB
MD5

b39369b7ec82f688abfefa8040a9508a
SHA1

e75d8b69c1a7591be07e80b477a3a9bed5c9d49d
SHA256

bd211ecbb120889ac6cee9b51bd8ca180e8cb19fe32c40cc3f734990b3ef9f9f
SHA512

eaf74bff7a709ea8d8c9e93128423c62b1cadb193ee5994ca8d8612319e10e277899cf899229bab665a0328219401e3489bb2bbdf0d6cf56392390b26de3baa6
SSDEEP

768:zdSqemqpj1O7K+ZO4ZZQsYni6sq7E+UOTy:5reDjpQOcZNYnir1OTy

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

b39369b7ec82f688abfefa8040a9508a.exe

pid process

2652 b39369b7ec82f688abfefa8040a9508a.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

b39369b7ec82f688abfefa8040a9508a.exe

description pid process target process

PID 2652 set thread context of 2780 2652 b39369b7ec82f688abfefa8040a9508a.exe b39369b7ec82f688abfefa8040a9508a.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b39369b7ec82f688abfefa8040a9508a.exe

pid process

2652 b39369b7ec82f688abfefa8040a9508a.exe

pid	process
2652	b39369b7ec82f688abfefa8040a9508a.exe

description	pid	process	target process
PID 2652 set thread context of 2780	2652	b39369b7ec82f688abfefa8040a9508a.exe	b39369b7ec82f688abfefa8040a9508a.exe

pid	process
2652	b39369b7ec82f688abfefa8040a9508a.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b39369b7ec82f688abfefa8040a9508a.exe

description	pid	process	target process
PID 2652 wrote to memory of 2780	2652	b39369b7ec82f688abfefa8040a9508a.exe	b39369b7ec82f688abfefa8040a9508a.exe
PID 2652 wrote to memory of 2780	2652	b39369b7ec82f688abfefa8040a9508a.exe	b39369b7ec82f688abfefa8040a9508a.exe
PID 2652 wrote to memory of 2780	2652	b39369b7ec82f688abfefa8040a9508a.exe	b39369b7ec82f688abfefa8040a9508a.exe
PID 2652 wrote to memory of 2780	2652	b39369b7ec82f688abfefa8040a9508a.exe	b39369b7ec82f688abfefa8040a9508a.exe
PID 2652 wrote to memory of 2780	2652	b39369b7ec82f688abfefa8040a9508a.exe	b39369b7ec82f688abfefa8040a9508a.exe
PID 2652 wrote to memory of 2780	2652	b39369b7ec82f688abfefa8040a9508a.exe	b39369b7ec82f688abfefa8040a9508a.exe
PID 2652 wrote to memory of 2780	2652	b39369b7ec82f688abfefa8040a9508a.exe	b39369b7ec82f688abfefa8040a9508a.exe
PID 2652 wrote to memory of 2780	2652	b39369b7ec82f688abfefa8040a9508a.exe	b39369b7ec82f688abfefa8040a9508a.exe

C:\Users\Admin\AppData\Local\Temp\b39369b7ec82f688abfefa8040a9508a.exe
"C:\Users\Admin\AppData\Local\Temp\b39369b7ec82f688abfefa8040a9508a.exe"
2⤵
PID:2780

\Users\Admin\AppData\Local\Temp\GdDbfFkd6k.log
Filesize
10KB

MD5
7d302421ec83f28a2446b3773214c247

SHA1
4c2b3dbdeecd9afb3e65ced3d6fa2ef33a79dc94

SHA256
c7b09518fe5100b7909e6f3adc3fcab85394360601809b344339c806298806f5

SHA512
6c427dbc26fae36c91d3fcbd88389914036622b8161d7e480c90031ae597e67f7b08aaa10890dfa40f45363d18e6c81b35a7c42dee6ad4aba442c44a05bb55c4

Download Submit
memory/2652-29-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/2652-20-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/2652-21-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/2652-32-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/2652-19-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/2780-25-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2780-27-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2780-30-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2780-33-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2780-37-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2780-41-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2780-42-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download