7f5eb389aa6e188ed32de31adc4679492fc5054a808d3de9a7a99b031fa8be0a

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:42

Target

03735c07ce73fc89615223a3107f20c7.exe
Size

103KB
MD5

03735c07ce73fc89615223a3107f20c7
SHA1

a39e16bc9387c4ea3dbb0669c1363a167baa15c4
SHA256

7f5eb389aa6e188ed32de31adc4679492fc5054a808d3de9a7a99b031fa8be0a
SHA512

aa320a3b47927c22f859f780b403ea785c0872e4d37675070d685f5393c917fe665889dd76f5baf3548320f1e26208d5e382853970dac27da44efb966f8f5273
SSDEEP

3072:Tth7C3R5r0fTBJ9uouQQdI8GekLEwNrGPvbH6w:TthElKlJ9NuQQdIVekZrMvba

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2456 set thread context of 1724	2456	03735c07ce73fc89615223a3107f20c7.exe	28

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 1724	2456	03735c07ce73fc89615223a3107f20c7.exe	28
PID 2456 wrote to memory of 1724	2456	03735c07ce73fc89615223a3107f20c7.exe	28
PID 2456 wrote to memory of 1724	2456	03735c07ce73fc89615223a3107f20c7.exe	28
PID 2456 wrote to memory of 1724	2456	03735c07ce73fc89615223a3107f20c7.exe	28
PID 2456 wrote to memory of 1724	2456	03735c07ce73fc89615223a3107f20c7.exe	28
PID 2456 wrote to memory of 1724	2456	03735c07ce73fc89615223a3107f20c7.exe	28
PID 2456 wrote to memory of 1724	2456	03735c07ce73fc89615223a3107f20c7.exe	28
PID 2456 wrote to memory of 1724	2456	03735c07ce73fc89615223a3107f20c7.exe	28
PID 2456 wrote to memory of 1724	2456	03735c07ce73fc89615223a3107f20c7.exe	28

C:\Users\Admin\AppData\Local\Temp\03735c07ce73fc89615223a3107f20c7.exe
"C:\Users\Admin\AppData\Local\Temp\03735c07ce73fc89615223a3107f20c7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\03735c07ce73fc89615223a3107f20c7.exe
  "C:\Users\Admin\AppData\Local\Temp\03735c07ce73fc89615223a3107f20c7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724

memory/1724-0-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1724-2-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1724-4-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1724-7-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1724-10-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1724-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1724-15-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1724-16-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2456-14-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download