618a3e8104c32a9f840c7879a795d77aba89804a69681c629d2065471f9dbdbc

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 05:16

Target

88a6ce9b0f91c666531024957298efb2.exe
Size

55KB
MD5

88a6ce9b0f91c666531024957298efb2
SHA1

b80d63d0a34f815ce21de08c9285994192a276fd
SHA256

618a3e8104c32a9f840c7879a795d77aba89804a69681c629d2065471f9dbdbc
SHA512

3bb0652985b4bec452b6fb7e3e2943e9e427570ef9e7e64a7d32e704a4346dd757299b2703526c4a78574cbd3c0c8a782e82df2d3584dca4d34247acf91ff246
SSDEEP

1536:ZdxtHvczlNVceuiqPO9ptt7IV5lwIPM+0LJ6pga:BtH5iqPmptCVLPOI

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 2872	1672	88a6ce9b0f91c666531024957298efb2.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1672	88a6ce9b0f91c666531024957298efb2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2872	1672	88a6ce9b0f91c666531024957298efb2.exe	28
PID 1672 wrote to memory of 2872	1672	88a6ce9b0f91c666531024957298efb2.exe	28
PID 1672 wrote to memory of 2872	1672	88a6ce9b0f91c666531024957298efb2.exe	28
PID 1672 wrote to memory of 2872	1672	88a6ce9b0f91c666531024957298efb2.exe	28
PID 1672 wrote to memory of 2872	1672	88a6ce9b0f91c666531024957298efb2.exe	28
PID 1672 wrote to memory of 2872	1672	88a6ce9b0f91c666531024957298efb2.exe	28
PID 1672 wrote to memory of 2872	1672	88a6ce9b0f91c666531024957298efb2.exe	28
PID 1672 wrote to memory of 2872	1672	88a6ce9b0f91c666531024957298efb2.exe	28

C:\Users\Admin\AppData\Local\Temp\88a6ce9b0f91c666531024957298efb2.exe
"C:\Users\Admin\AppData\Local\Temp\88a6ce9b0f91c666531024957298efb2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\88a6ce9b0f91c666531024957298efb2.EXE
  "C:\Users\Admin\AppData\Local\Temp\88a6ce9b0f91c666531024957298efb2.EXE"
  2⤵
  PID:2872

memory/1672-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1672-5-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2872-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2872-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2872-6-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2872-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2872-9-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2872-10-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download