7c21bea65fe8de699d0d2989b89488b2640ab2eda8b7dfb1bfeba655a8113712

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 03:31

Target

c4dddfba143b11b6a674c2a48a17d27e.exe
Size

215KB
MD5

c4dddfba143b11b6a674c2a48a17d27e
SHA1

1b012f91bfe625d63b88825a068aa6a4c714b310
SHA256

7c21bea65fe8de699d0d2989b89488b2640ab2eda8b7dfb1bfeba655a8113712
SHA512

fe739d7a8eeb6e0febb14a030201036492de3f0aa7ab71795b70528e70c24bdc7cf1a939a382446e25e24df4968ca291fee2140aa1c6b5c6c0f85778e01c37ec
SSDEEP

3072:15PDykjCBx2hypK7D6zdX3+P+kdMTvgz38QZy7LbHmDOKkpXCOQOnB81iK/:xowgLbH9rpyO1nBQ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2740 set thread context of 1968	2740	c4dddfba143b11b6a674c2a48a17d27e.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1968	c4dddfba143b11b6a674c2a48a17d27e.exe
1968	c4dddfba143b11b6a674c2a48a17d27e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2740	c4dddfba143b11b6a674c2a48a17d27e.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1968	2740	c4dddfba143b11b6a674c2a48a17d27e.exe	28
PID 2740 wrote to memory of 1968	2740	c4dddfba143b11b6a674c2a48a17d27e.exe	28
PID 2740 wrote to memory of 1968	2740	c4dddfba143b11b6a674c2a48a17d27e.exe	28
PID 2740 wrote to memory of 1968	2740	c4dddfba143b11b6a674c2a48a17d27e.exe	28
PID 2740 wrote to memory of 1968	2740	c4dddfba143b11b6a674c2a48a17d27e.exe	28
PID 2740 wrote to memory of 1968	2740	c4dddfba143b11b6a674c2a48a17d27e.exe	28
PID 2740 wrote to memory of 1968	2740	c4dddfba143b11b6a674c2a48a17d27e.exe	28
PID 2740 wrote to memory of 1968	2740	c4dddfba143b11b6a674c2a48a17d27e.exe	28
PID 1968 wrote to memory of 1208	1968	c4dddfba143b11b6a674c2a48a17d27e.exe	21
PID 1968 wrote to memory of 1208	1968	c4dddfba143b11b6a674c2a48a17d27e.exe	21
PID 1968 wrote to memory of 1208	1968	c4dddfba143b11b6a674c2a48a17d27e.exe	21
PID 1968 wrote to memory of 1208	1968	c4dddfba143b11b6a674c2a48a17d27e.exe	21

memory/1208-8-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1208-12-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1968-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1968-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1968-3-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1968-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1968-11-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1968-22-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download