4499ff51f9e44e4a55b0d2f33d1791ee1f18c60e4b472c274bfadde149c992dc

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:14

Target

0b508e8a07b91758e0240bb5a881a0bb.exe
Size

84KB
MD5

0b508e8a07b91758e0240bb5a881a0bb
SHA1

43caaf2bb84394547805903616714e7dede32025
SHA256

4499ff51f9e44e4a55b0d2f33d1791ee1f18c60e4b472c274bfadde149c992dc
SHA512

9595b823aeddfb36e9c21908c8b890106f30e4c8a336259b353718acf9ad157c8549d8a8d583bcd9fe7084049a0f73183214e6efbc3472d652c7c3478cc42359
SSDEEP

1536:uc1tCIbP5Q++oqcLaGv6SzLdeytury3J5MWY3cYsmgSwPMJ0:uc1tCIK++omGv6CLdbtury33/xNdv

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 2760	2040	0b508e8a07b91758e0240bb5a881a0bb.exe	14

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2760	0b508e8a07b91758e0240bb5a881a0bb.exe
2760	0b508e8a07b91758e0240bb5a881a0bb.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2760	2040	0b508e8a07b91758e0240bb5a881a0bb.exe	14
PID 2040 wrote to memory of 2760	2040	0b508e8a07b91758e0240bb5a881a0bb.exe	14
PID 2040 wrote to memory of 2760	2040	0b508e8a07b91758e0240bb5a881a0bb.exe	14
PID 2040 wrote to memory of 2760	2040	0b508e8a07b91758e0240bb5a881a0bb.exe	14
PID 2040 wrote to memory of 2760	2040	0b508e8a07b91758e0240bb5a881a0bb.exe	14
PID 2040 wrote to memory of 2760	2040	0b508e8a07b91758e0240bb5a881a0bb.exe	14
PID 2040 wrote to memory of 2760	2040	0b508e8a07b91758e0240bb5a881a0bb.exe	14
PID 2040 wrote to memory of 2760	2040	0b508e8a07b91758e0240bb5a881a0bb.exe	14
PID 2760 wrote to memory of 1328	2760	0b508e8a07b91758e0240bb5a881a0bb.exe	12
PID 2760 wrote to memory of 1328	2760	0b508e8a07b91758e0240bb5a881a0bb.exe	12
PID 2760 wrote to memory of 1328	2760	0b508e8a07b91758e0240bb5a881a0bb.exe	12
PID 2760 wrote to memory of 1328	2760	0b508e8a07b91758e0240bb5a881a0bb.exe	12
PID 2760 wrote to memory of 1328	2760	0b508e8a07b91758e0240bb5a881a0bb.exe	12
PID 2760 wrote to memory of 1328	2760	0b508e8a07b91758e0240bb5a881a0bb.exe	12

memory/1328-23-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/1328-15-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/2040-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2760-19-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2760-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2760-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2760-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2760-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2760-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2760-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2760-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download