f13cf796d7c60ef92882baddbefd79e9ca9784c76423e415b585af5627ae2bec

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:43

Target

1a68373abb433f833ecac1feb086dc14.exe
Size

71KB
MD5

1a68373abb433f833ecac1feb086dc14
SHA1

e7320210fe13a5a0d7ad099ba7a71bdbc6fc50b5
SHA256

f13cf796d7c60ef92882baddbefd79e9ca9784c76423e415b585af5627ae2bec
SHA512

dd34a8310a9741a59ab1ad2b396c74c1d53da557a3b7a10488a46483344ae0683672f9dddd0f6d7e27b313ae5686d7ce15ce52e1874d2fd2b4d35316eecf62ce
SSDEEP

1536:uR5U2dUbcCNET1KXNKcAWFgVeyciaaA00TKsm+:uR5U2dUgCNlQsiaZF

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 2928	2896	1a68373abb433f833ecac1feb086dc14.exe	17

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2928	1a68373abb433f833ecac1feb086dc14.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2896	1a68373abb433f833ecac1feb086dc14.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2928	2896	1a68373abb433f833ecac1feb086dc14.exe	17
PID 2896 wrote to memory of 2928	2896	1a68373abb433f833ecac1feb086dc14.exe	17
PID 2896 wrote to memory of 2928	2896	1a68373abb433f833ecac1feb086dc14.exe	17
PID 2896 wrote to memory of 2928	2896	1a68373abb433f833ecac1feb086dc14.exe	17
PID 2896 wrote to memory of 2928	2896	1a68373abb433f833ecac1feb086dc14.exe	17
PID 2896 wrote to memory of 2928	2896	1a68373abb433f833ecac1feb086dc14.exe	17
PID 2896 wrote to memory of 2928	2896	1a68373abb433f833ecac1feb086dc14.exe	17
PID 2896 wrote to memory of 2928	2896	1a68373abb433f833ecac1feb086dc14.exe	17
PID 2896 wrote to memory of 2928	2896	1a68373abb433f833ecac1feb086dc14.exe	17
PID 2896 wrote to memory of 2928	2896	1a68373abb433f833ecac1feb086dc14.exe	17
PID 2896 wrote to memory of 2928	2896	1a68373abb433f833ecac1feb086dc14.exe	17
PID 2896 wrote to memory of 2928	2896	1a68373abb433f833ecac1feb086dc14.exe	17

C:\Users\Admin\AppData\Local\Temp\1a68373abb433f833ecac1feb086dc14.exe
"C:\Users\Admin\AppData\Local\Temp\1a68373abb433f833ecac1feb086dc14.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\1a68373abb433f833ecac1feb086dc14.exe
  C:\Users\Admin\AppData\Local\Temp\1a68373abb433f833ecac1feb086dc14.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2928

memory/2928-27-0x0000000000400000-0x000000000040F7AC-memory.dmp

Filesize
61KB

Download
memory/2928-26-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2928-25-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2928-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2928-20-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2928-18-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2928-16-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2928-13-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2928-9-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2928-6-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2928-4-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2928-2-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download