f83d266edd4a93593e7c7036b4158bec17b835c258e718942477b6166b436f2b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 11:08

Target

7212f31932ab204115bb1a73cc8f4f71.exe
Size

60KB
MD5

7212f31932ab204115bb1a73cc8f4f71
SHA1

e52ff0f10448305504af6b9028b88cd77bb15a3e
SHA256

f83d266edd4a93593e7c7036b4158bec17b835c258e718942477b6166b436f2b
SHA512

0833b5870cb9fc84c28fa0eb7438b8b109916985474e7b47fcd599013db718a09545604e08e1c3305ce9e9a0d951102eabc52385238ae5f13d8229b1972a399f
SSDEEP

1536:5M8Z3CkWaCG/h17D+NNNJ0HcjpZuOF8LcgfE0nJ34:6KVCKrIsHcDuORgfbI

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 952 set thread context of 1464	952	7212f31932ab204115bb1a73cc8f4f71.exe	19

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1464	7212f31932ab204115bb1a73cc8f4f71.exe
1464	7212f31932ab204115bb1a73cc8f4f71.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
952	7212f31932ab204115bb1a73cc8f4f71.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1464	952	7212f31932ab204115bb1a73cc8f4f71.exe	19
PID 952 wrote to memory of 1464	952	7212f31932ab204115bb1a73cc8f4f71.exe	19
PID 952 wrote to memory of 1464	952	7212f31932ab204115bb1a73cc8f4f71.exe	19
PID 952 wrote to memory of 1464	952	7212f31932ab204115bb1a73cc8f4f71.exe	19
PID 952 wrote to memory of 1464	952	7212f31932ab204115bb1a73cc8f4f71.exe	19
PID 952 wrote to memory of 1464	952	7212f31932ab204115bb1a73cc8f4f71.exe	19
PID 952 wrote to memory of 1464	952	7212f31932ab204115bb1a73cc8f4f71.exe	19
PID 952 wrote to memory of 1464	952	7212f31932ab204115bb1a73cc8f4f71.exe	19
PID 1464 wrote to memory of 1376	1464	7212f31932ab204115bb1a73cc8f4f71.exe	7
PID 1464 wrote to memory of 1376	1464	7212f31932ab204115bb1a73cc8f4f71.exe	7
PID 1464 wrote to memory of 1376	1464	7212f31932ab204115bb1a73cc8f4f71.exe	7
PID 1464 wrote to memory of 1376	1464	7212f31932ab204115bb1a73cc8f4f71.exe	7

memory/952-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/952-4-0x0000000000330000-0x0000000000369000-memory.dmp

Filesize
228KB

Download
memory/952-7-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1376-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1376-14-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1464-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1464-6-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1464-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1464-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1464-13-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1464-23-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download