30dbaf93bd336570f902dba0d258a8647f4e97e73974f1765b025098b16c6748

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 03:03

Target

a0c6f5d3aef11b3bcb53dc4bcffb0868.exe
Size

108KB
MD5

a0c6f5d3aef11b3bcb53dc4bcffb0868
SHA1

a73633141f87abe09d35a83700725a2d9aa8747a
SHA256

30dbaf93bd336570f902dba0d258a8647f4e97e73974f1765b025098b16c6748
SHA512

63a183c39f9f20c8e0ee923d4f24ac5c3135c518bfb941cdd25093f3b071631e1fb2d8a540ad384e4ba1c6767e2ccbb2f866de29ccc8e6a8c9264f3786f9302c
SSDEEP

1536:q6ujHq0yENFaJEaxCZaYTCEewnZ1sglRsbmoQKFSVjOzNha5z5N1NMDsMs8K:qne88EaxwaZE5zVWmPKFSUzNCz3ssb8K

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2292 set thread context of 1228	2292	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2292	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe
1228	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1228	2292	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	28
PID 2292 wrote to memory of 1228	2292	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	28
PID 2292 wrote to memory of 1228	2292	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	28
PID 2292 wrote to memory of 1228	2292	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	28
PID 2292 wrote to memory of 1228	2292	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	28
PID 2292 wrote to memory of 1228	2292	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	28
PID 2292 wrote to memory of 1228	2292	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	28
PID 2292 wrote to memory of 1228	2292	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	28
PID 2292 wrote to memory of 1228	2292	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	28

C:\Users\Admin\AppData\Local\Temp\a0c6f5d3aef11b3bcb53dc4bcffb0868.exe
"C:\Users\Admin\AppData\Local\Temp\a0c6f5d3aef11b3bcb53dc4bcffb0868.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\a0c6f5d3aef11b3bcb53dc4bcffb0868.exe
  C:\Users\Admin\AppData\Local\Temp\a0c6f5d3aef11b3bcb53dc4bcffb0868.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1228

memory/1228-4-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1228-7-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1228-10-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1228-11-0x0000000000410000-0x0000000000477000-memory.dmp

Filesize
412KB

Download
memory/1228-12-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2292-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2292-2-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2292-6-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download