66699f496293caa9e3e31c5720bf23749e3c67ebd86b471749dd4c9d86ab5683

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 00:26

Target

9802b511089843b7b7ceb3571394e47f.exe
Size

264KB
MD5

9802b511089843b7b7ceb3571394e47f
SHA1

4c2e7e4fce96922c8a518ea3130117281725feb3
SHA256

66699f496293caa9e3e31c5720bf23749e3c67ebd86b471749dd4c9d86ab5683
SHA512

7856422011e26658af786628b02c54f9d746023f84877d3187b5e60f64b9244d075bb7e2dbea5df08d820feb3f75b8a1764e0d04549a2897cff533b813d79239
SSDEEP

1536:ysPMJ249icel/Z01/NBX4UDpegM3zwACUJGLq42GrElP2T/1oHd5RVJ6OmYmz2OV:ysEX0e1FB/DpKjCLH+mYEJn3r9

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1216 set thread context of 1376	1216	9802b511089843b7b7ceb3571394e47f.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1376	9802b511089843b7b7ceb3571394e47f.exe
1376	9802b511089843b7b7ceb3571394e47f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1216	9802b511089843b7b7ceb3571394e47f.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1376	1216	9802b511089843b7b7ceb3571394e47f.exe	28
PID 1216 wrote to memory of 1376	1216	9802b511089843b7b7ceb3571394e47f.exe	28
PID 1216 wrote to memory of 1376	1216	9802b511089843b7b7ceb3571394e47f.exe	28
PID 1216 wrote to memory of 1376	1216	9802b511089843b7b7ceb3571394e47f.exe	28
PID 1216 wrote to memory of 1376	1216	9802b511089843b7b7ceb3571394e47f.exe	28
PID 1216 wrote to memory of 1376	1216	9802b511089843b7b7ceb3571394e47f.exe	28
PID 1216 wrote to memory of 1376	1216	9802b511089843b7b7ceb3571394e47f.exe	28
PID 1216 wrote to memory of 1376	1216	9802b511089843b7b7ceb3571394e47f.exe	28
PID 1376 wrote to memory of 1264	1376	9802b511089843b7b7ceb3571394e47f.exe	17
PID 1376 wrote to memory of 1264	1376	9802b511089843b7b7ceb3571394e47f.exe	17
PID 1376 wrote to memory of 1264	1376	9802b511089843b7b7ceb3571394e47f.exe	17
PID 1376 wrote to memory of 1264	1376	9802b511089843b7b7ceb3571394e47f.exe	17

memory/1264-8-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1264-11-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1376-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1376-3-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1376-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1376-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1376-7-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1376-21-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1376-22-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download