44a4541965dd5ac1fbb6082b4352aa1244bf14b02980eafa8520a7c57aa322b3

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 10:11

Target

b87a90f5c99cf8744ebfaac1de254e4b.exe
Size

144KB
MD5

b87a90f5c99cf8744ebfaac1de254e4b
SHA1

0898fd61a804e8acc971dd953fea6885734bc774
SHA256

44a4541965dd5ac1fbb6082b4352aa1244bf14b02980eafa8520a7c57aa322b3
SHA512

8305f2142863b14176419e16269d1beb60c5bcd015ccdc65721bd84f430f78ed3da6cb71886b2fd2baceb186a63bc651b1356ee2b95fdfcbdf0ef451f8f158f7
SSDEEP

768:L780Jkxb13JkcmjqkxKA2GPUfMm6/6NQtslqJ8NQtslytlgPRIms0NWDUxcf3bG4:f80M5kD1bmOmJQCIg633B/1PV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2512 set thread context of 2936	2512	b87a90f5c99cf8744ebfaac1de254e4b.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2512	b87a90f5c99cf8744ebfaac1de254e4b.exe
2936	b87a90f5c99cf8744ebfaac1de254e4b.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2936	2512	b87a90f5c99cf8744ebfaac1de254e4b.exe	28
PID 2512 wrote to memory of 2936	2512	b87a90f5c99cf8744ebfaac1de254e4b.exe	28
PID 2512 wrote to memory of 2936	2512	b87a90f5c99cf8744ebfaac1de254e4b.exe	28
PID 2512 wrote to memory of 2936	2512	b87a90f5c99cf8744ebfaac1de254e4b.exe	28
PID 2512 wrote to memory of 2936	2512	b87a90f5c99cf8744ebfaac1de254e4b.exe	28
PID 2512 wrote to memory of 2936	2512	b87a90f5c99cf8744ebfaac1de254e4b.exe	28
PID 2512 wrote to memory of 2936	2512	b87a90f5c99cf8744ebfaac1de254e4b.exe	28
PID 2512 wrote to memory of 2936	2512	b87a90f5c99cf8744ebfaac1de254e4b.exe	28
PID 2512 wrote to memory of 2936	2512	b87a90f5c99cf8744ebfaac1de254e4b.exe	28

C:\Users\Admin\AppData\Local\Temp\b87a90f5c99cf8744ebfaac1de254e4b.exe
"C:\Users\Admin\AppData\Local\Temp\b87a90f5c99cf8744ebfaac1de254e4b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\b87a90f5c99cf8744ebfaac1de254e4b.exe
  C:\Users\Admin\AppData\Local\Temp\b87a90f5c99cf8744ebfaac1de254e4b.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2936

memory/2936-2-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2936-7-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download