b472550f70366f4298cc001988690844580a5d38b5882873cc55885443155b5f

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:40

Target

0738fb3a700466f6fae17f932441245c.exe
Size

55KB
MD5

0738fb3a700466f6fae17f932441245c
SHA1

21519e851bf3c0fb38c8372bfe39ea94a99d7e38
SHA256

b472550f70366f4298cc001988690844580a5d38b5882873cc55885443155b5f
SHA512

c2ddfbc3b8f7e72709798ed9d77aea06a4602b5d810f6d7296024075d26869e77f22ebe28b71189222b20601400080b2cd17792d685cc4a8d31f73d99dbe2c25
SSDEEP

768:WSRcEMPG+msITGx9Xqb8JY2p4sMh627s9/hRuiFwDhhsKHHx:1XSmrTSXqQJYvsP27eZRuishs4x

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 3056	2868	0738fb3a700466f6fae17f932441245c.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3056	0738fb3a700466f6fae17f932441245c.exe
3056	0738fb3a700466f6fae17f932441245c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2868	0738fb3a700466f6fae17f932441245c.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3056	2868	0738fb3a700466f6fae17f932441245c.exe	28
PID 2868 wrote to memory of 3056	2868	0738fb3a700466f6fae17f932441245c.exe	28
PID 2868 wrote to memory of 3056	2868	0738fb3a700466f6fae17f932441245c.exe	28
PID 2868 wrote to memory of 3056	2868	0738fb3a700466f6fae17f932441245c.exe	28
PID 2868 wrote to memory of 3056	2868	0738fb3a700466f6fae17f932441245c.exe	28
PID 2868 wrote to memory of 3056	2868	0738fb3a700466f6fae17f932441245c.exe	28
PID 2868 wrote to memory of 3056	2868	0738fb3a700466f6fae17f932441245c.exe	28
PID 2868 wrote to memory of 3056	2868	0738fb3a700466f6fae17f932441245c.exe	28
PID 3056 wrote to memory of 1196	3056	0738fb3a700466f6fae17f932441245c.exe	15
PID 3056 wrote to memory of 1196	3056	0738fb3a700466f6fae17f932441245c.exe	15
PID 3056 wrote to memory of 1196	3056	0738fb3a700466f6fae17f932441245c.exe	15
PID 3056 wrote to memory of 1196	3056	0738fb3a700466f6fae17f932441245c.exe	15

memory/1196-15-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1196-18-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/3056-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3056-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3056-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3056-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3056-11-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3056-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3056-14-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3056-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3056-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3056-28-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3056-29-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download