be2a70a5280a1772ebe907f4f58e30e95d05e34578d3476c2e54c5cd444f5d5e

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:00

Target

38f420445be41ac7e3b71aa0ce0dceac.exe
Size

1.3MB
MD5

38f420445be41ac7e3b71aa0ce0dceac
SHA1

219c79176f0fc265885f14170c33cb06fdabd305
SHA256

be2a70a5280a1772ebe907f4f58e30e95d05e34578d3476c2e54c5cd444f5d5e
SHA512

586cdc7ed78df37cbed9381ea3d05884ca9964e508aedb88019792d4bc2593dda35d4dbcdfb133b810a850acb73565ad2343b7afc497ee3c2961b7050de5f1e4
SSDEEP

24576:hbXexCKdVAnWh553bHaqyZYtCLzFXLybS5q1wbXE:hbOxCtng55LH0cCLzF7yO5c

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2540	38f420445be41ac7e3b71aa0ce0dceac.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2728	2540	38f420445be41ac7e3b71aa0ce0dceac.exe	28
PID 2540 wrote to memory of 2728	2540	38f420445be41ac7e3b71aa0ce0dceac.exe	28
PID 2540 wrote to memory of 2728	2540	38f420445be41ac7e3b71aa0ce0dceac.exe	28
PID 2540 wrote to memory of 2728	2540	38f420445be41ac7e3b71aa0ce0dceac.exe	28

C:\Users\Admin\AppData\Local\Temp\38f420445be41ac7e3b71aa0ce0dceac.exe
"C:\Users\Admin\AppData\Local\Temp\38f420445be41ac7e3b71aa0ce0dceac.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 548
  2⤵
  PID:2728

memory/2540-0-0x00000000001C0000-0x00000000005B4000-memory.dmp

Filesize
4.0MB

Download
memory/2540-1-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/2540-3-0x00000000009C0000-0x0000000000A00000-memory.dmp

Filesize
256KB

Download
memory/2540-2-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/2540-6-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/2540-7-0x00000000009C0000-0x0000000000A00000-memory.dmp

Filesize
256KB

Download
memory/2728-4-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/2728-8-0x00000000024B0000-0x00000000028A4000-memory.dmp

Filesize
4.0MB

Download