42f93b69de546676814bce6ccf337b379e2c2942d0560a2e8f60f3a25a1cfef1

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:21

Target

19d259f7a25f2487d4161eb70f7fa8be.exe
Size

204KB
MD5

19d259f7a25f2487d4161eb70f7fa8be
SHA1

c59c48e4376342007f558bf1bc00f8d6a0a4f5f2
SHA256

42f93b69de546676814bce6ccf337b379e2c2942d0560a2e8f60f3a25a1cfef1
SHA512

3f4746f1df7f3d48544c6a1eee15f2a194d17578b335ad108297dbcc2e8f686da64c2a2a4ad8a9ff6ff93a5d6603fd6ed40dff2d3f5a0d2154e27e945b306d9d
SSDEEP

6144:ugP7FaPhWr97ASvBSoxTqTNn136MMo3WpidPf6AIIN7:ugjFihkhA6qZ13hHs8nnr7

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 624 set thread context of 2996	624	19d259f7a25f2487d4161eb70f7fa8be.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2996	19d259f7a25f2487d4161eb70f7fa8be.exe
2996	19d259f7a25f2487d4161eb70f7fa8be.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
624	19d259f7a25f2487d4161eb70f7fa8be.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2996	624	19d259f7a25f2487d4161eb70f7fa8be.exe	28
PID 624 wrote to memory of 2996	624	19d259f7a25f2487d4161eb70f7fa8be.exe	28
PID 624 wrote to memory of 2996	624	19d259f7a25f2487d4161eb70f7fa8be.exe	28
PID 624 wrote to memory of 2996	624	19d259f7a25f2487d4161eb70f7fa8be.exe	28
PID 624 wrote to memory of 2996	624	19d259f7a25f2487d4161eb70f7fa8be.exe	28
PID 624 wrote to memory of 2996	624	19d259f7a25f2487d4161eb70f7fa8be.exe	28
PID 624 wrote to memory of 2996	624	19d259f7a25f2487d4161eb70f7fa8be.exe	28
PID 624 wrote to memory of 2996	624	19d259f7a25f2487d4161eb70f7fa8be.exe	28
PID 2996 wrote to memory of 1360	2996	19d259f7a25f2487d4161eb70f7fa8be.exe	16
PID 2996 wrote to memory of 1360	2996	19d259f7a25f2487d4161eb70f7fa8be.exe	16
PID 2996 wrote to memory of 1360	2996	19d259f7a25f2487d4161eb70f7fa8be.exe	16
PID 2996 wrote to memory of 1360	2996	19d259f7a25f2487d4161eb70f7fa8be.exe	16

memory/624-0-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/624-2-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/624-5-0x0000000002860000-0x000000000292E000-memory.dmp

Filesize
824KB

Download
memory/624-8-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/1360-11-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1360-15-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2996-6-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2996-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2996-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2996-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2996-14-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2996-25-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download