33de1c79692f1c219e2b95eebd269147d0a7fc03418fb5de8a4134bc40580fdf

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 07:07

Target

a32d0f8ec4dcfa0af6fe42f4f834151f.exe
Size

179KB
MD5

a32d0f8ec4dcfa0af6fe42f4f834151f
SHA1

7f8ab51302b7a4e5f02035e06fdd8c1ce3ff2bdb
SHA256

33de1c79692f1c219e2b95eebd269147d0a7fc03418fb5de8a4134bc40580fdf
SHA512

b22f28e508256dbd428d8661870d3768fd5f68bd1914a7a447f93f429914a4edef7503c157193d6ae6831f5fa1f69c268fc2a62a745a354c8f830adfd68f9417
SSDEEP

3072:j9jwZu0lwuQKYYIHFOe8oZOCGxKe8UpC66ppS6vA1Pzrc77OWw8x8ca:hkZ3lVYVH0e8oZOzK10CnXec769/ca

Score

5^/10

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2216 set thread context of 1384	2216	a32d0f8ec4dcfa0af6fe42f4f834151f.exe	28
PID 2216 set thread context of 0	2216	a32d0f8ec4dcfa0af6fe42f4f834151f.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	a32d0f8ec4dcfa0af6fe42f4f834151f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	a32d0f8ec4dcfa0af6fe42f4f834151f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1384	a32d0f8ec4dcfa0af6fe42f4f834151f.exe
1384	a32d0f8ec4dcfa0af6fe42f4f834151f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2216	a32d0f8ec4dcfa0af6fe42f4f834151f.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1384	2216	a32d0f8ec4dcfa0af6fe42f4f834151f.exe	28
PID 2216 wrote to memory of 1384	2216	a32d0f8ec4dcfa0af6fe42f4f834151f.exe	28
PID 2216 wrote to memory of 1384	2216	a32d0f8ec4dcfa0af6fe42f4f834151f.exe	28
PID 2216 wrote to memory of 1384	2216	a32d0f8ec4dcfa0af6fe42f4f834151f.exe	28
PID 2216 wrote to memory of 1384	2216	a32d0f8ec4dcfa0af6fe42f4f834151f.exe	28
PID 2216 wrote to memory of 1384	2216	a32d0f8ec4dcfa0af6fe42f4f834151f.exe	28
PID 2216 wrote to memory of 1384	2216	a32d0f8ec4dcfa0af6fe42f4f834151f.exe	28
PID 2216 wrote to memory of 1384	2216	a32d0f8ec4dcfa0af6fe42f4f834151f.exe	28
PID 2216 wrote to memory of 0	2216	a32d0f8ec4dcfa0af6fe42f4f834151f.exe
PID 2216 wrote to memory of 0	2216	a32d0f8ec4dcfa0af6fe42f4f834151f.exe
PID 2216 wrote to memory of 0	2216	a32d0f8ec4dcfa0af6fe42f4f834151f.exe
PID 2216 wrote to memory of 0	2216	a32d0f8ec4dcfa0af6fe42f4f834151f.exe
PID 1384 wrote to memory of 1176	1384	a32d0f8ec4dcfa0af6fe42f4f834151f.exe	14
PID 1384 wrote to memory of 1176	1384	a32d0f8ec4dcfa0af6fe42f4f834151f.exe	14
PID 1384 wrote to memory of 1176	1384	a32d0f8ec4dcfa0af6fe42f4f834151f.exe	14
PID 1384 wrote to memory of 1176	1384	a32d0f8ec4dcfa0af6fe42f4f834151f.exe	14

memory/1176-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1176-13-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1384-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1384-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1384-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1384-9-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1384-24-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2216-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2216-1-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2216-6-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download