5a6e831ea2a7b978338d657bfda0b6017972fc7bdcb3ba50e69ad29f2a015915

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 01:37

Target

47b0aa770bc07feeee1edf0b8c85e30e.exe
Size

313KB
MD5

47b0aa770bc07feeee1edf0b8c85e30e
SHA1

21f565bee8d4ec6c59de75cb493d71c03889b934
SHA256

5a6e831ea2a7b978338d657bfda0b6017972fc7bdcb3ba50e69ad29f2a015915
SHA512

fd914f75ff0d05104a39c02255fbcaf8c63f93d2f53fa53edf92f71eced0794b629976ec00f7573033860e893033966488cb9aebfbf9ea9dd1594d72adb187ee
SSDEEP

3072:s3LT3Hn4jUVkWmKEboEXnuYH94zWQMhbvvM1933+1TaGcG6Dg4uTcXAoWGilUghQ:Wi3WmzB3uYH90WQG633+1GU6DroXUaQ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2812 set thread context of 2324	2812	47b0aa770bc07feeee1edf0b8c85e30e.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2812	47b0aa770bc07feeee1edf0b8c85e30e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2324	2812	47b0aa770bc07feeee1edf0b8c85e30e.exe	28
PID 2812 wrote to memory of 2324	2812	47b0aa770bc07feeee1edf0b8c85e30e.exe	28
PID 2812 wrote to memory of 2324	2812	47b0aa770bc07feeee1edf0b8c85e30e.exe	28
PID 2812 wrote to memory of 2324	2812	47b0aa770bc07feeee1edf0b8c85e30e.exe	28
PID 2812 wrote to memory of 2324	2812	47b0aa770bc07feeee1edf0b8c85e30e.exe	28
PID 2812 wrote to memory of 2324	2812	47b0aa770bc07feeee1edf0b8c85e30e.exe	28
PID 2812 wrote to memory of 2324	2812	47b0aa770bc07feeee1edf0b8c85e30e.exe	28
PID 2812 wrote to memory of 2324	2812	47b0aa770bc07feeee1edf0b8c85e30e.exe	28
PID 2812 wrote to memory of 2324	2812	47b0aa770bc07feeee1edf0b8c85e30e.exe	28

C:\Users\Admin\AppData\Local\Temp\47b0aa770bc07feeee1edf0b8c85e30e.exe
"C:\Users\Admin\AppData\Local\Temp\47b0aa770bc07feeee1edf0b8c85e30e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Users\Admin\AppData\Local\Temp\47b0aa770bc07feeee1edf0b8c85e30e.exe
  "C:\Users\Admin\AppData\Local\Temp\47b0aa770bc07feeee1edf0b8c85e30e.exe"
  2⤵
  PID:2324

memory/2324-17-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2324-15-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2324-9-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2324-11-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2324-7-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2324-27-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2324-5-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2324-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2324-25-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2324-23-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2324-18-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2324-20-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2812-2-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2812-3-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2812-4-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download