24280f810e9892b66aaf0582eabe346388c302c3b2cbcbd6cdbaafce7112cc0f

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 08:51

Target

64fc4552700b0521514f9ad4b9375d5e.exe
Size

51KB
MD5

64fc4552700b0521514f9ad4b9375d5e
SHA1

52c3b4f99a373b5ef0a0ab05e411f5307f7c44e9
SHA256

24280f810e9892b66aaf0582eabe346388c302c3b2cbcbd6cdbaafce7112cc0f
SHA512

f577dcd0f18b5e3b9713da33a6e03578bf9b7f11965c34141325543665f5f5eb6725593936958e47aab15016c42167a6f296009e73a6def283cce96d34c00348
SSDEEP

768:Cy/gXq3MGqMYMEAIfxJGUrhMuDAPRCqggIg9NyZuKMS7DVKsFNdj:rgXqcKSDhML5ZiGEu90Kg

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2872 set thread context of 2748	2872	64fc4552700b0521514f9ad4b9375d5e.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2872	64fc4552700b0521514f9ad4b9375d5e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2748	2872	64fc4552700b0521514f9ad4b9375d5e.exe	28
PID 2872 wrote to memory of 2748	2872	64fc4552700b0521514f9ad4b9375d5e.exe	28
PID 2872 wrote to memory of 2748	2872	64fc4552700b0521514f9ad4b9375d5e.exe	28
PID 2872 wrote to memory of 2748	2872	64fc4552700b0521514f9ad4b9375d5e.exe	28
PID 2872 wrote to memory of 2748	2872	64fc4552700b0521514f9ad4b9375d5e.exe	28
PID 2872 wrote to memory of 2748	2872	64fc4552700b0521514f9ad4b9375d5e.exe	28
PID 2872 wrote to memory of 2748	2872	64fc4552700b0521514f9ad4b9375d5e.exe	28
PID 2872 wrote to memory of 2748	2872	64fc4552700b0521514f9ad4b9375d5e.exe	28

C:\Users\Admin\AppData\Local\Temp\64fc4552700b0521514f9ad4b9375d5e.exe
"C:\Users\Admin\AppData\Local\Temp\64fc4552700b0521514f9ad4b9375d5e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\64fc4552700b0521514f9ad4b9375d5e.EXE
  "C:\Users\Admin\AppData\Local\Temp\64fc4552700b0521514f9ad4b9375d5e.EXE"
  2⤵
  PID:2748

memory/2748-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2748-6-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2748-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2748-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2748-9-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2748-10-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2748-11-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2872-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2872-5-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download