d45fd89bf852ea0cef216d1c04bef8a7f7eabffc92e5f8de3f81d868ef9b3bbe

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17/01/2024, 23:11

Target

63daf808b026a2be636831070c16d149.exe
Size

44KB
MD5

63daf808b026a2be636831070c16d149
SHA1

295a3c7926eac4615c2a1fd200b47dc006e0bfc4
SHA256

d45fd89bf852ea0cef216d1c04bef8a7f7eabffc92e5f8de3f81d868ef9b3bbe
SHA512

07557922807945bb7ad69ba2958396173c3610e60f145fc661223bc6609f088592c511497f89ac46f7b58ec2088d84d11283eee9adf3c596481fd955859b127c
SSDEEP

384:uJvX1fRV7DxGR8RY6lD7dA07RNzFFOgT2FWREbQ6OasGPc5ht0nnnqHlQyx:uJd55lm2Y67djNpE1FXOa85ht2qHV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2404 set thread context of 2940	2404	63daf808b026a2be636831070c16d149.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2404	63daf808b026a2be636831070c16d149.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2940	2404	63daf808b026a2be636831070c16d149.exe	28
PID 2404 wrote to memory of 2940	2404	63daf808b026a2be636831070c16d149.exe	28
PID 2404 wrote to memory of 2940	2404	63daf808b026a2be636831070c16d149.exe	28
PID 2404 wrote to memory of 2940	2404	63daf808b026a2be636831070c16d149.exe	28
PID 2404 wrote to memory of 2940	2404	63daf808b026a2be636831070c16d149.exe	28
PID 2404 wrote to memory of 2940	2404	63daf808b026a2be636831070c16d149.exe	28
PID 2404 wrote to memory of 2940	2404	63daf808b026a2be636831070c16d149.exe	28
PID 2404 wrote to memory of 2940	2404	63daf808b026a2be636831070c16d149.exe	28

C:\Users\Admin\AppData\Local\Temp\63daf808b026a2be636831070c16d149.exe
"C:\Users\Admin\AppData\Local\Temp\63daf808b026a2be636831070c16d149.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\63daf808b026a2be636831070c16d149.exe
  C:\Users\Admin\AppData\Local\Temp\63daf808b026a2be636831070c16d149.exe
  2⤵
  PID:2940

memory/2940-2-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2940-4-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2940-6-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2940-7-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2940-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2940-11-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download