41ba30bf0b96675401b94cde532db55b418255302fc899cc57b22e4c3c370a3f

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 07:59

Target

7f4e21c4a6d17ba47224197b241afaf4.exe
Size

293KB
MD5

7f4e21c4a6d17ba47224197b241afaf4
SHA1

19a169bbc7391ddfff25224d79a64fe7ab09442d
SHA256

41ba30bf0b96675401b94cde532db55b418255302fc899cc57b22e4c3c370a3f
SHA512

94dfb73ed366b43561d6d32982dcf4d8f7f222920e53b825e59eae6e9d658e2d9d9a2262e4be3eb66b4ad52548011deb16ca57408c0e7333c03071c779ec237b
SSDEEP

6144:lmgHOgGyeynE5JQfzDRj2/JxVg3KStVZ5d485vvE2:lmQO8e5vQrDKxytpE2

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1924 set thread context of 2324	1924	7f4e21c4a6d17ba47224197b241afaf4.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1924	7f4e21c4a6d17ba47224197b241afaf4.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2324	1924	7f4e21c4a6d17ba47224197b241afaf4.exe	28
PID 1924 wrote to memory of 2324	1924	7f4e21c4a6d17ba47224197b241afaf4.exe	28
PID 1924 wrote to memory of 2324	1924	7f4e21c4a6d17ba47224197b241afaf4.exe	28
PID 1924 wrote to memory of 2324	1924	7f4e21c4a6d17ba47224197b241afaf4.exe	28
PID 1924 wrote to memory of 2324	1924	7f4e21c4a6d17ba47224197b241afaf4.exe	28
PID 1924 wrote to memory of 2324	1924	7f4e21c4a6d17ba47224197b241afaf4.exe	28
PID 1924 wrote to memory of 2324	1924	7f4e21c4a6d17ba47224197b241afaf4.exe	28
PID 1924 wrote to memory of 2324	1924	7f4e21c4a6d17ba47224197b241afaf4.exe	28
PID 1924 wrote to memory of 2324	1924	7f4e21c4a6d17ba47224197b241afaf4.exe	28

C:\Users\Admin\AppData\Local\Temp\7f4e21c4a6d17ba47224197b241afaf4.exe
"C:\Users\Admin\AppData\Local\Temp\7f4e21c4a6d17ba47224197b241afaf4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\7f4e21c4a6d17ba47224197b241afaf4.exe
  "C:\Users\Admin\AppData\Local\Temp\7f4e21c4a6d17ba47224197b241afaf4.exe"
  2⤵
  PID:2324

memory/1924-3-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1924-2-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1924-6-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2324-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2324-7-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2324-9-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2324-11-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2324-15-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2324-4-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2324-17-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2324-19-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2324-25-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2324-23-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2324-21-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2324-27-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2324-18-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download