e92ddb532e33e18d895b902b5985f35994b4176cf9d6838b7b3625f9c79bd244

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 09:35

Target

14a3c2e3dfdb884e6820c6d104564ccf.exe
Size

607KB
MD5

14a3c2e3dfdb884e6820c6d104564ccf
SHA1

2f806bdac610ed35db2932fef89f609d3fd98f91
SHA256

e92ddb532e33e18d895b902b5985f35994b4176cf9d6838b7b3625f9c79bd244
SHA512

5cf82f52c20c2623d6123ee4c336783fd7120cc6c9bef0c48162890f79d766a9f7d8a3683a2135aba042bf652122cdf4cd89c239a035d4dc1d3c9a53809d3a50
SSDEEP

12288:cMe35Hf+z/10ysEEX0Wd5AYqXMmNcEjv3BsNM:cpJHfCpEEoOYs9jvS

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2360	1820	14a3c2e3dfdb884e6820c6d104564ccf.exe	28
PID 1820 wrote to memory of 2360	1820	14a3c2e3dfdb884e6820c6d104564ccf.exe	28
PID 1820 wrote to memory of 2360	1820	14a3c2e3dfdb884e6820c6d104564ccf.exe	28
PID 1820 wrote to memory of 2360	1820	14a3c2e3dfdb884e6820c6d104564ccf.exe	28
PID 1820 wrote to memory of 3064	1820	14a3c2e3dfdb884e6820c6d104564ccf.exe	29
PID 1820 wrote to memory of 3064	1820	14a3c2e3dfdb884e6820c6d104564ccf.exe	29
PID 1820 wrote to memory of 3064	1820	14a3c2e3dfdb884e6820c6d104564ccf.exe	29
PID 1820 wrote to memory of 3064	1820	14a3c2e3dfdb884e6820c6d104564ccf.exe	29

C:\Users\Admin\AppData\Local\Temp\14a3c2e3dfdb884e6820c6d104564ccf.exe
"C:\Users\Admin\AppData\Local\Temp\14a3c2e3dfdb884e6820c6d104564ccf.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Users\Admin\AppData\Local\Temp\14a3c2e3dfdb884e6820c6d104564ccf.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2360
- C:\Users\Admin\AppData\Local\Temp\14a3c2e3dfdb884e6820c6d104564ccf.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3064

memory/1820-6-0x0000000001E30000-0x0000000001ECB000-memory.dmp

Filesize
620KB

Download
memory/1820-1-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/1820-2-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1820-3-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/1820-4-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1820-0-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2360-11-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2360-10-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2360-5-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2360-12-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/3064-7-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/3064-9-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/3064-13-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download