47b29b3642240a38bb966b6213172f32bf63226c346236184e9144fc6bc461bd

Analysis

max time kernel
150s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 08:37

Target

4dda616237867cbf3a6527d943e2445c.exe
Size

68KB
MD5

4dda616237867cbf3a6527d943e2445c
SHA1

016b5adc058fe1f61fe29f83baf2498ac911d428
SHA256

47b29b3642240a38bb966b6213172f32bf63226c346236184e9144fc6bc461bd
SHA512

be38bdd9b00b0cc63876391154b23b88b0ebdaaa29974c03ca4914c8dd946a8f9b2ab59d38cb8323cc1a2bea579b9cd253118cfb3db70480b276dfabd6925506
SSDEEP

768:VQcepF+Yxt+mV0eMwd1Jg5YUFfbihi8x1A73mLqaX7UCTR+jrjaE:SceH+Yxt+WJlg5dTihXDuPaE

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 2236	2148	4dda616237867cbf3a6527d943e2445c.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2148	4dda616237867cbf3a6527d943e2445c.exe
2236	4dda616237867cbf3a6527d943e2445c.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2236	2148	4dda616237867cbf3a6527d943e2445c.exe	27
PID 2148 wrote to memory of 2236	2148	4dda616237867cbf3a6527d943e2445c.exe	27
PID 2148 wrote to memory of 2236	2148	4dda616237867cbf3a6527d943e2445c.exe	27
PID 2148 wrote to memory of 2236	2148	4dda616237867cbf3a6527d943e2445c.exe	27
PID 2148 wrote to memory of 2236	2148	4dda616237867cbf3a6527d943e2445c.exe	27
PID 2148 wrote to memory of 2236	2148	4dda616237867cbf3a6527d943e2445c.exe	27
PID 2148 wrote to memory of 2236	2148	4dda616237867cbf3a6527d943e2445c.exe	27
PID 2148 wrote to memory of 2236	2148	4dda616237867cbf3a6527d943e2445c.exe	27
PID 2148 wrote to memory of 2236	2148	4dda616237867cbf3a6527d943e2445c.exe	27

C:\Users\Admin\AppData\Local\Temp\4dda616237867cbf3a6527d943e2445c.exe
"C:\Users\Admin\AppData\Local\Temp\4dda616237867cbf3a6527d943e2445c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\4dda616237867cbf3a6527d943e2445c.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2236

memory/2236-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2236-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2236-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download