849839cd89ec266a8bdcde81cafceb943acc25034dc951a73efb15fbba7fea15

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 21:11

Target

68a5df9f7774f4ca201e61f0e3b30d2b.exe
Size

114KB
MD5

68a5df9f7774f4ca201e61f0e3b30d2b
SHA1

35c2dec799016c549b5661284b9d8903a170027d
SHA256

849839cd89ec266a8bdcde81cafceb943acc25034dc951a73efb15fbba7fea15
SHA512

9f18bdf99eef2255292b6d623ea11933d73dc1e8c41c4a9fe402d9cad899505f2bcb69cd42e11585b7fd17a179afddf5f02cde849784e3632e5f64f2650bb9ce
SSDEEP

1536:uxSu1pTLv7gk3skKScAbFkSa21rHfRINYqrZZK1s/AcqGqCFd5/qFOfFiLnEWq0S:3uTb7gk1bFhTrpQ7T/ArGqcsQdiSB

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2968 set thread context of 2884	2968	68a5df9f7774f4ca201e61f0e3b30d2b.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2968	68a5df9f7774f4ca201e61f0e3b30d2b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2884	2968	68a5df9f7774f4ca201e61f0e3b30d2b.exe	28
PID 2968 wrote to memory of 2884	2968	68a5df9f7774f4ca201e61f0e3b30d2b.exe	28
PID 2968 wrote to memory of 2884	2968	68a5df9f7774f4ca201e61f0e3b30d2b.exe	28
PID 2968 wrote to memory of 2884	2968	68a5df9f7774f4ca201e61f0e3b30d2b.exe	28
PID 2968 wrote to memory of 2884	2968	68a5df9f7774f4ca201e61f0e3b30d2b.exe	28
PID 2968 wrote to memory of 2884	2968	68a5df9f7774f4ca201e61f0e3b30d2b.exe	28
PID 2968 wrote to memory of 2884	2968	68a5df9f7774f4ca201e61f0e3b30d2b.exe	28
PID 2968 wrote to memory of 2884	2968	68a5df9f7774f4ca201e61f0e3b30d2b.exe	28

C:\Users\Admin\AppData\Local\Temp\68a5df9f7774f4ca201e61f0e3b30d2b.exe
"C:\Users\Admin\AppData\Local\Temp\68a5df9f7774f4ca201e61f0e3b30d2b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\68a5df9f7774f4ca201e61f0e3b30d2b.exe
  C:\Users\Admin\AppData\Local\Temp\68a5df9f7774f4ca201e61f0e3b30d2b.exe
  2⤵
  PID:2884

memory/2884-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2884-9-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2884-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2884-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2884-11-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2884-12-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2968-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2968-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2968-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2968-8-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download