b0183a866190180c8718f721ced468b4d6d8421fa181070e71817f9f2092a3e3

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 11:48

Target

86d0c7fee47ef072f691f632849f9271.exe
Size

76KB
MD5

86d0c7fee47ef072f691f632849f9271
SHA1

5722a0f401ff98874c3829fd020fba2190a9a348
SHA256

b0183a866190180c8718f721ced468b4d6d8421fa181070e71817f9f2092a3e3
SHA512

35cd94a5ff074f3ab59d9a036563c9d31a7fd333f68c8e7bea54bda4828d2de80dcc03c4de83cb97730e751766411bdf0fb53f0da02f232368423c428fda8f00
SSDEEP

1536:9n3Qq3j4vnP0zU83g5E8fzzxq43erqNLvjmt3PNQBA3j3peFmOZnybks:W0enPf834E8fQOIqJbA/NeAT345R9s

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2080 set thread context of 2208	2080	86d0c7fee47ef072f691f632849f9271.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2080	86d0c7fee47ef072f691f632849f9271.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2208	2080	86d0c7fee47ef072f691f632849f9271.exe	28
PID 2080 wrote to memory of 2208	2080	86d0c7fee47ef072f691f632849f9271.exe	28
PID 2080 wrote to memory of 2208	2080	86d0c7fee47ef072f691f632849f9271.exe	28
PID 2080 wrote to memory of 2208	2080	86d0c7fee47ef072f691f632849f9271.exe	28
PID 2080 wrote to memory of 2208	2080	86d0c7fee47ef072f691f632849f9271.exe	28
PID 2080 wrote to memory of 2208	2080	86d0c7fee47ef072f691f632849f9271.exe	28
PID 2080 wrote to memory of 2208	2080	86d0c7fee47ef072f691f632849f9271.exe	28
PID 2080 wrote to memory of 2208	2080	86d0c7fee47ef072f691f632849f9271.exe	28

C:\Users\Admin\AppData\Local\Temp\86d0c7fee47ef072f691f632849f9271.exe
"C:\Users\Admin\AppData\Local\Temp\86d0c7fee47ef072f691f632849f9271.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\86d0c7fee47ef072f691f632849f9271.exe
  "C:\Users\Admin\AppData\Local\Temp\86d0c7fee47ef072f691f632849f9271.exe"
  2⤵
  PID:2208

memory/2208-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2208-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-16-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download