ecaa1c280350845a2c043a7d3244efefc8a671291f81b81cec0060af1ce198ca

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 10:37

Target

7ce6c417c4dcc18d3814be3952a7f59a.exe
Size

43KB
MD5

7ce6c417c4dcc18d3814be3952a7f59a
SHA1

3a65c1ff41bcad70af40d75465256ebaeed77994
SHA256

ecaa1c280350845a2c043a7d3244efefc8a671291f81b81cec0060af1ce198ca
SHA512

cfb016b4a4d3b9ec0cee411016e69aba91f8323f1e0200256503f4c795ad089527f738141909dbd3dfa0f88d1de633d01a18836fef884b5385267affa7ab0a25
SSDEEP

768:wC19DlJj0nxV8gMxXyyAdCWM67ayAZCQ3th5aO2rqsNwiE0Q14Psr7DL:wCPRzxXG57aylQ9hr1svE084kP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 2676	1732	7ce6c417c4dcc18d3814be3952a7f59a.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1732	7ce6c417c4dcc18d3814be3952a7f59a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2676	1732	7ce6c417c4dcc18d3814be3952a7f59a.exe	28
PID 1732 wrote to memory of 2676	1732	7ce6c417c4dcc18d3814be3952a7f59a.exe	28
PID 1732 wrote to memory of 2676	1732	7ce6c417c4dcc18d3814be3952a7f59a.exe	28
PID 1732 wrote to memory of 2676	1732	7ce6c417c4dcc18d3814be3952a7f59a.exe	28
PID 1732 wrote to memory of 2676	1732	7ce6c417c4dcc18d3814be3952a7f59a.exe	28
PID 1732 wrote to memory of 2676	1732	7ce6c417c4dcc18d3814be3952a7f59a.exe	28
PID 1732 wrote to memory of 2676	1732	7ce6c417c4dcc18d3814be3952a7f59a.exe	28
PID 1732 wrote to memory of 2676	1732	7ce6c417c4dcc18d3814be3952a7f59a.exe	28

C:\Users\Admin\AppData\Local\Temp\7ce6c417c4dcc18d3814be3952a7f59a.exe
"C:\Users\Admin\AppData\Local\Temp\7ce6c417c4dcc18d3814be3952a7f59a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\7ce6c417c4dcc18d3814be3952a7f59a.exe
  "C:\Users\Admin\AppData\Local\Temp\7ce6c417c4dcc18d3814be3952a7f59a.exe"
  2⤵
  PID:2676

memory/1732-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1732-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2676-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2676-4-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2676-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2676-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2676-9-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2676-10-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download