c80b68ed7c11b36f14aaf21653b8c0eee3e013795e605680d3bab93db2233891

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 02:52

Target

3fb433c7b810a6d649b6dafac9688407.exe
Size

380KB
MD5

3fb433c7b810a6d649b6dafac9688407
SHA1

b57c91189a865371ce29125eb01e707f58506596
SHA256

c80b68ed7c11b36f14aaf21653b8c0eee3e013795e605680d3bab93db2233891
SHA512

e0aa40bf6d62673cbb57f9f8fd58a028ab2a7dc0854a6ac4d3658ef4b36b1df28d54e863c9e953121a27459621389daff5246987e269c7a84ceffbaa7e06d067
SSDEEP

3072:daC8ftFSy253FYpcag/LJ3+3w0I5DS5DIKRA7Pzrc77OWw8x8cF:ICIOlFCcV/4teDgDBCc769/cF

Score

5^/10

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2224 set thread context of 2648	2224	3fb433c7b810a6d649b6dafac9688407.exe	28
PID 2224 set thread context of 0	2224	3fb433c7b810a6d649b6dafac9688407.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2648	3fb433c7b810a6d649b6dafac9688407.exe
2648	3fb433c7b810a6d649b6dafac9688407.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2224	3fb433c7b810a6d649b6dafac9688407.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2648	2224	3fb433c7b810a6d649b6dafac9688407.exe	28
PID 2224 wrote to memory of 2648	2224	3fb433c7b810a6d649b6dafac9688407.exe	28
PID 2224 wrote to memory of 2648	2224	3fb433c7b810a6d649b6dafac9688407.exe	28
PID 2224 wrote to memory of 2648	2224	3fb433c7b810a6d649b6dafac9688407.exe	28
PID 2224 wrote to memory of 2648	2224	3fb433c7b810a6d649b6dafac9688407.exe	28
PID 2224 wrote to memory of 2648	2224	3fb433c7b810a6d649b6dafac9688407.exe	28
PID 2224 wrote to memory of 2648	2224	3fb433c7b810a6d649b6dafac9688407.exe	28
PID 2224 wrote to memory of 2648	2224	3fb433c7b810a6d649b6dafac9688407.exe	28
PID 2224 wrote to memory of 0	2224	3fb433c7b810a6d649b6dafac9688407.exe
PID 2224 wrote to memory of 0	2224	3fb433c7b810a6d649b6dafac9688407.exe
PID 2224 wrote to memory of 0	2224	3fb433c7b810a6d649b6dafac9688407.exe
PID 2224 wrote to memory of 0	2224	3fb433c7b810a6d649b6dafac9688407.exe
PID 2648 wrote to memory of 1252	2648	3fb433c7b810a6d649b6dafac9688407.exe	10
PID 2648 wrote to memory of 1252	2648	3fb433c7b810a6d649b6dafac9688407.exe	10
PID 2648 wrote to memory of 1252	2648	3fb433c7b810a6d649b6dafac9688407.exe	10
PID 2648 wrote to memory of 1252	2648	3fb433c7b810a6d649b6dafac9688407.exe	10

memory/1252-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1252-13-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2224-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2224-7-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2648-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2648-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2648-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2648-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2648-9-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2648-23-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download