bfd1c881e6aec8003a27631182ccc10b7fb3b2c068cea277802a6162e3588662

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 07:45

Target

71ab22bdc50f095303d3457648fe3e9d.exe
Size

156KB
MD5

71ab22bdc50f095303d3457648fe3e9d
SHA1

3f3344b878dca00c57f2c45bc7a8bbaff332c9b5
SHA256

bfd1c881e6aec8003a27631182ccc10b7fb3b2c068cea277802a6162e3588662
SHA512

049fe99905c54e4a66f37b5c611d4c7065f39e75458e724803a62bf752990f01a13e96b2e9a76fb5ce1a390b10fb94cefd7de214e376dd32aff5d87bb63a68fb
SSDEEP

3072:ik8nPG7EnskALzKjoP4vvRSsiWtZiZjnlVYUb716qZeuL5kV2npLw/+ThAM:i9a4Ys3ctnlVRXZeuL5kVcI+R

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3040 set thread context of 3052	3040	71ab22bdc50f095303d3457648fe3e9d.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3052	71ab22bdc50f095303d3457648fe3e9d.exe
3052	71ab22bdc50f095303d3457648fe3e9d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3040	71ab22bdc50f095303d3457648fe3e9d.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3052	3040	71ab22bdc50f095303d3457648fe3e9d.exe	28
PID 3040 wrote to memory of 3052	3040	71ab22bdc50f095303d3457648fe3e9d.exe	28
PID 3040 wrote to memory of 3052	3040	71ab22bdc50f095303d3457648fe3e9d.exe	28
PID 3040 wrote to memory of 3052	3040	71ab22bdc50f095303d3457648fe3e9d.exe	28
PID 3040 wrote to memory of 3052	3040	71ab22bdc50f095303d3457648fe3e9d.exe	28
PID 3040 wrote to memory of 3052	3040	71ab22bdc50f095303d3457648fe3e9d.exe	28
PID 3040 wrote to memory of 3052	3040	71ab22bdc50f095303d3457648fe3e9d.exe	28
PID 3040 wrote to memory of 3052	3040	71ab22bdc50f095303d3457648fe3e9d.exe	28
PID 3052 wrote to memory of 1272	3052	71ab22bdc50f095303d3457648fe3e9d.exe	12
PID 3052 wrote to memory of 1272	3052	71ab22bdc50f095303d3457648fe3e9d.exe	12
PID 3052 wrote to memory of 1272	3052	71ab22bdc50f095303d3457648fe3e9d.exe	12
PID 3052 wrote to memory of 1272	3052	71ab22bdc50f095303d3457648fe3e9d.exe	12

memory/1272-7-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1272-10-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/3052-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3052-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3052-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3052-6-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3052-19-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3052-21-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download