ddd9ae4b08fbd76a69682836bd020802557f9a872ccbdefca7fb11c71f1bf4be

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 03:48

Target

73a7fa12a990794a1d65456f6711cf36.exe
Size

152KB
MD5

73a7fa12a990794a1d65456f6711cf36
SHA1

263c055f1ffe01db7957842d47b1676700ffb900
SHA256

ddd9ae4b08fbd76a69682836bd020802557f9a872ccbdefca7fb11c71f1bf4be
SHA512

a1398b0a63bde2aac0301f579d26ce6301dd2edf66c566bc7cbd6f0ae4ac2d5fda5fd161d0dc32bbc437166b705d8559db39c9ad35211c0f050f5d12e45af516
SSDEEP

3072:zRQVEUP0Fx0k4MWJjFalEadPFO0c6p866zn/4bR1/X:zR71

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2928 set thread context of 2404	2928	73a7fa12a990794a1d65456f6711cf36.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2928	73a7fa12a990794a1d65456f6711cf36.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2404	2928	73a7fa12a990794a1d65456f6711cf36.exe	28
PID 2928 wrote to memory of 2404	2928	73a7fa12a990794a1d65456f6711cf36.exe	28
PID 2928 wrote to memory of 2404	2928	73a7fa12a990794a1d65456f6711cf36.exe	28
PID 2928 wrote to memory of 2404	2928	73a7fa12a990794a1d65456f6711cf36.exe	28
PID 2928 wrote to memory of 2404	2928	73a7fa12a990794a1d65456f6711cf36.exe	28
PID 2928 wrote to memory of 2404	2928	73a7fa12a990794a1d65456f6711cf36.exe	28
PID 2928 wrote to memory of 2404	2928	73a7fa12a990794a1d65456f6711cf36.exe	28
PID 2928 wrote to memory of 2404	2928	73a7fa12a990794a1d65456f6711cf36.exe	28

C:\Users\Admin\AppData\Local\Temp\73a7fa12a990794a1d65456f6711cf36.exe
"C:\Users\Admin\AppData\Local\Temp\73a7fa12a990794a1d65456f6711cf36.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\73a7fa12a990794a1d65456f6711cf36.exe
  C:\Users\Admin\AppData\Local\Temp\73a7fa12a990794a1d65456f6711cf36.exe
  2⤵
  PID:2404

memory/2404-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2404-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2404-5-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2404-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2404-9-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download