84f90b4cf53a18efb77065a22c705bf055a93eee9f69a4c6d893926f5912ab3b

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 09:28

Target

407e8b7484604a78cfb39e9708098eb4.exe
Size

217KB
MD5

407e8b7484604a78cfb39e9708098eb4
SHA1

04667f6102a206049b053569fb11302f51fb658d
SHA256

84f90b4cf53a18efb77065a22c705bf055a93eee9f69a4c6d893926f5912ab3b
SHA512

009aae145bfd1f3c29a326ed8bf36ca18a0b6a04c408993c7e0fcafcf784962ba4d0814a0f4e4d444db3764dc68f31af02b7bc6cd9f3b6951245b82e1581bcb3
SSDEEP

6144:Pv2mt+/7OdThwus5emGS7YW1OQe1Y2h8iyziXtHF:j+/7zemsPQe1bhOzi9HF

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1472 set thread context of 2864	1472	407e8b7484604a78cfb39e9708098eb4.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2864	407e8b7484604a78cfb39e9708098eb4.exe
2864	407e8b7484604a78cfb39e9708098eb4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1472	407e8b7484604a78cfb39e9708098eb4.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 2864	1472	407e8b7484604a78cfb39e9708098eb4.exe	28
PID 1472 wrote to memory of 2864	1472	407e8b7484604a78cfb39e9708098eb4.exe	28
PID 1472 wrote to memory of 2864	1472	407e8b7484604a78cfb39e9708098eb4.exe	28
PID 1472 wrote to memory of 2864	1472	407e8b7484604a78cfb39e9708098eb4.exe	28
PID 1472 wrote to memory of 2864	1472	407e8b7484604a78cfb39e9708098eb4.exe	28
PID 1472 wrote to memory of 2864	1472	407e8b7484604a78cfb39e9708098eb4.exe	28
PID 1472 wrote to memory of 2864	1472	407e8b7484604a78cfb39e9708098eb4.exe	28
PID 1472 wrote to memory of 2864	1472	407e8b7484604a78cfb39e9708098eb4.exe	28
PID 1472 wrote to memory of 2864	1472	407e8b7484604a78cfb39e9708098eb4.exe	28
PID 2864 wrote to memory of 1392	2864	407e8b7484604a78cfb39e9708098eb4.exe	18
PID 2864 wrote to memory of 1392	2864	407e8b7484604a78cfb39e9708098eb4.exe	18
PID 2864 wrote to memory of 1392	2864	407e8b7484604a78cfb39e9708098eb4.exe	18
PID 2864 wrote to memory of 1392	2864	407e8b7484604a78cfb39e9708098eb4.exe	18

memory/1392-8-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1392-11-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2864-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2864-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2864-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2864-6-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2864-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2864-20-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download