4ac002b7e28d95575ea8cdfa906dbb5f9ec0bdef6f35f6393e26af28e30c9a49

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:29

Target

2a08855e615abd31fe1417a503ccce54.exe
Size

69KB
MD5

2a08855e615abd31fe1417a503ccce54
SHA1

a803853135650472021fd416b04e5f5592919afe
SHA256

4ac002b7e28d95575ea8cdfa906dbb5f9ec0bdef6f35f6393e26af28e30c9a49
SHA512

98f98d9e930c610184ef7a2dc6363dc4535bdcbfff4c28ae08146266c3b92a78bcd424e21d1fd37bd9f921f3a0631eea1c56eafd5da0ac5dd15de95b003cfadd
SSDEEP

1536:aXRBF7YskzjXY/Wt+Fk0dtKGy58JS7y6jrg0iWfEM0:0FUsajXYT6GGiS7y6P3R0

Score

5^/10

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 2404	3068	2a08855e615abd31fe1417a503ccce54.exe	28
PID 3068 set thread context of 0	3068	2a08855e615abd31fe1417a503ccce54.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2404	2a08855e615abd31fe1417a503ccce54.exe
2404	2a08855e615abd31fe1417a503ccce54.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3068	2a08855e615abd31fe1417a503ccce54.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2404	3068	2a08855e615abd31fe1417a503ccce54.exe	28
PID 3068 wrote to memory of 2404	3068	2a08855e615abd31fe1417a503ccce54.exe	28
PID 3068 wrote to memory of 2404	3068	2a08855e615abd31fe1417a503ccce54.exe	28
PID 3068 wrote to memory of 2404	3068	2a08855e615abd31fe1417a503ccce54.exe	28
PID 3068 wrote to memory of 2404	3068	2a08855e615abd31fe1417a503ccce54.exe	28
PID 3068 wrote to memory of 2404	3068	2a08855e615abd31fe1417a503ccce54.exe	28
PID 3068 wrote to memory of 2404	3068	2a08855e615abd31fe1417a503ccce54.exe	28
PID 3068 wrote to memory of 2404	3068	2a08855e615abd31fe1417a503ccce54.exe	28
PID 3068 wrote to memory of 0	3068	2a08855e615abd31fe1417a503ccce54.exe
PID 3068 wrote to memory of 0	3068	2a08855e615abd31fe1417a503ccce54.exe
PID 3068 wrote to memory of 0	3068	2a08855e615abd31fe1417a503ccce54.exe
PID 3068 wrote to memory of 0	3068	2a08855e615abd31fe1417a503ccce54.exe
PID 2404 wrote to memory of 1324	2404	2a08855e615abd31fe1417a503ccce54.exe	17
PID 2404 wrote to memory of 1324	2404	2a08855e615abd31fe1417a503ccce54.exe	17
PID 2404 wrote to memory of 1324	2404	2a08855e615abd31fe1417a503ccce54.exe	17
PID 2404 wrote to memory of 1324	2404	2a08855e615abd31fe1417a503ccce54.exe	17

memory/1324-13-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1324-16-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2404-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2404-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2404-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2404-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2404-11-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2404-27-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3068-1-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/3068-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3068-4-0x0000000000290000-0x00000000002BE000-memory.dmp

Filesize
184KB

Download
memory/3068-10-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download