3e8b1ea84ad2d991323a9df69f5bedece5252c0f7cb83139a25f9441ca98a131

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:51

Target

12a2b6c279a648577e1ce5fa1a35afc3.exe
Size

604KB
MD5

12a2b6c279a648577e1ce5fa1a35afc3
SHA1

d9f25ad9e5705246278df8aab3762c0a5be7fc64
SHA256

3e8b1ea84ad2d991323a9df69f5bedece5252c0f7cb83139a25f9441ca98a131
SHA512

36444c069c0763c22f06ab71570eb9818db937c978324a94610dbc37a3362ddbb4596cee4e75415c8193dcb02bdb721c6e197dd82590ad8eb85280e16283dcfe
SSDEEP

12288:iTC7O4L2AudlNj0E852PaPuou8UYYZY/BwTDKlu/cQ/4M:iTCK4L0Nj0l5x1u8IZYpwTDKlu/cs

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2936	2348	12a2b6c279a648577e1ce5fa1a35afc3.exe	30
PID 2348 wrote to memory of 2936	2348	12a2b6c279a648577e1ce5fa1a35afc3.exe	30
PID 2348 wrote to memory of 2936	2348	12a2b6c279a648577e1ce5fa1a35afc3.exe	30
PID 2348 wrote to memory of 2936	2348	12a2b6c279a648577e1ce5fa1a35afc3.exe	30
PID 2348 wrote to memory of 2148	2348	12a2b6c279a648577e1ce5fa1a35afc3.exe	29
PID 2348 wrote to memory of 2148	2348	12a2b6c279a648577e1ce5fa1a35afc3.exe	29
PID 2348 wrote to memory of 2148	2348	12a2b6c279a648577e1ce5fa1a35afc3.exe	29
PID 2348 wrote to memory of 2148	2348	12a2b6c279a648577e1ce5fa1a35afc3.exe	29

C:\Users\Admin\AppData\Local\Temp\12a2b6c279a648577e1ce5fa1a35afc3.exe
"C:\Users\Admin\AppData\Local\Temp\12a2b6c279a648577e1ce5fa1a35afc3.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\12a2b6c279a648577e1ce5fa1a35afc3.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2148
- C:\Users\Admin\AppData\Local\Temp\12a2b6c279a648577e1ce5fa1a35afc3.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2936

memory/2148-11-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2148-14-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2148-8-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2148-10-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2348-4-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/2348-5-0x0000000000AE0000-0x0000000000B7B000-memory.dmp

Filesize
620KB

Download
memory/2348-0-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2348-2-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2348-3-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2348-1-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2936-9-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2936-12-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2936-7-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2936-13-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download