61b87dcb98afdc53b66fa145076cc564d61bc8dfeef6a64057e9220550e9cc7c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 02:03

Target

5979abfafb5fd41b1122c0a195ca5c0a.exe
Size

55KB
MD5

5979abfafb5fd41b1122c0a195ca5c0a
SHA1

7283250caba3ba17bdf7421bb38086ed11e9bc98
SHA256

61b87dcb98afdc53b66fa145076cc564d61bc8dfeef6a64057e9220550e9cc7c
SHA512

800df4e795e9e32318ba1690b27cdf754df9077d83c0f6371caf6d1b4a335ef4f2abd752ebf1a9dcbf6b08c823db0dc8f1ccbb0ff891585335a41e8ca4f10eca
SSDEEP

768:DZ8bD9cBuDhs6oYBAFDUM9EG9YbcmfW0M7+71Ong+0prOIoAJuFdPYwdb/L/pU6U:Dq9cBuCb5KSDa5VbprBo6uXFd3ODkS

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2932 set thread context of 3048	2932	5979abfafb5fd41b1122c0a195ca5c0a.exe	16

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3048	5979abfafb5fd41b1122c0a195ca5c0a.exe
3048	5979abfafb5fd41b1122c0a195ca5c0a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2932	5979abfafb5fd41b1122c0a195ca5c0a.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 3048	2932	5979abfafb5fd41b1122c0a195ca5c0a.exe	16
PID 2932 wrote to memory of 3048	2932	5979abfafb5fd41b1122c0a195ca5c0a.exe	16
PID 2932 wrote to memory of 3048	2932	5979abfafb5fd41b1122c0a195ca5c0a.exe	16
PID 2932 wrote to memory of 3048	2932	5979abfafb5fd41b1122c0a195ca5c0a.exe	16
PID 2932 wrote to memory of 3048	2932	5979abfafb5fd41b1122c0a195ca5c0a.exe	16
PID 2932 wrote to memory of 3048	2932	5979abfafb5fd41b1122c0a195ca5c0a.exe	16
PID 2932 wrote to memory of 3048	2932	5979abfafb5fd41b1122c0a195ca5c0a.exe	16
PID 2932 wrote to memory of 3048	2932	5979abfafb5fd41b1122c0a195ca5c0a.exe	16
PID 3048 wrote to memory of 1340	3048	5979abfafb5fd41b1122c0a195ca5c0a.exe	8
PID 3048 wrote to memory of 1340	3048	5979abfafb5fd41b1122c0a195ca5c0a.exe	8
PID 3048 wrote to memory of 1340	3048	5979abfafb5fd41b1122c0a195ca5c0a.exe	8
PID 3048 wrote to memory of 1340	3048	5979abfafb5fd41b1122c0a195ca5c0a.exe	8

memory/1340-13-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1340-9-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2932-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2932-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3048-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3048-6-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3048-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3048-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3048-12-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3048-23-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download