bfd9ff0628cd77e3b4613d5f72908b572444aba25bbc53888e56c848022e3762

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 14:03

Target

9bde1a303eba8105a450c433a3c5962d.exe
Size

44KB
MD5

9bde1a303eba8105a450c433a3c5962d
SHA1

2ec50d70de8d088012f4625d9fe9d948ee2ad10d
SHA256

bfd9ff0628cd77e3b4613d5f72908b572444aba25bbc53888e56c848022e3762
SHA512

bf164c9da2767c05962e653482b8e395393e2222208e6400bce97409df7766a75ba98118607808bbf80d528879208de1f18f475c6efd68e347cc442692f89e21
SSDEEP

768:5y4G6ymC81RFRpRcRq/4OWWdctOwLT1k+SeKFfULA7yq2b/d35NP:Y4a8kOWW6NFkveK5UkyD

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2084 set thread context of 2056	2084	9bde1a303eba8105a450c433a3c5962d.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2084	9bde1a303eba8105a450c433a3c5962d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2056	2084	9bde1a303eba8105a450c433a3c5962d.exe	28
PID 2084 wrote to memory of 2056	2084	9bde1a303eba8105a450c433a3c5962d.exe	28
PID 2084 wrote to memory of 2056	2084	9bde1a303eba8105a450c433a3c5962d.exe	28
PID 2084 wrote to memory of 2056	2084	9bde1a303eba8105a450c433a3c5962d.exe	28
PID 2084 wrote to memory of 2056	2084	9bde1a303eba8105a450c433a3c5962d.exe	28

C:\Users\Admin\AppData\Local\Temp\9bde1a303eba8105a450c433a3c5962d.exe
"C:\Users\Admin\AppData\Local\Temp\9bde1a303eba8105a450c433a3c5962d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\9bde1a303eba8105a450c433a3c5962d.exe
  "C:\Users\Admin\AppData\Local\Temp\9bde1a303eba8105a450c433a3c5962d.exe"
  2⤵
  PID:2056

memory/2056-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2056-4-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download