a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 22:09

Target

a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe
Size

77KB
MD5

d70665734296658d54d8af8a494b29f4
SHA1

ea865f518d0cddb4bd053e1f7141084034d719a4
SHA256

a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0
SHA512

f6a4fae33e56f3b081706139c3c54ae4ab2d5deb55ac9a6d3ec8f993a6e45caf27fd38929cbc2bd603642574665bcdeb4dd75da54d451415f44eb2e8746b9c80
SSDEEP

1536:R61BsWcCXUDp0tUAbBUfP0gdtppT0bZuuI4ZHjrqKbVe5R:SJ5Yp0tU2g0gLppTwH6Kpo

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3032 set thread context of 1888	3032	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1888	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe
1888	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3032	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 1888	3032	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	28
PID 3032 wrote to memory of 1888	3032	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	28
PID 3032 wrote to memory of 1888	3032	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	28
PID 3032 wrote to memory of 1888	3032	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	28
PID 3032 wrote to memory of 1888	3032	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	28
PID 3032 wrote to memory of 1888	3032	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	28
PID 3032 wrote to memory of 1888	3032	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	28
PID 3032 wrote to memory of 1888	3032	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	28
PID 1888 wrote to memory of 1252	1888	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	21
PID 1888 wrote to memory of 1252	1888	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	21
PID 1888 wrote to memory of 1252	1888	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	21
PID 1888 wrote to memory of 1252	1888	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	21

memory/1252-11-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1252-15-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1888-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1888-8-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1888-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1888-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1888-12-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1888-25-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1888-26-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/3032-7-0x0000000000400000-0x0000000000407001-memory.dmp

Filesize
28KB

Download
memory/3032-3-0x0000000000230000-0x0000000000238000-memory.dmp

Filesize
32KB

Download
memory/3032-0-0x0000000000400000-0x0000000000407001-memory.dmp

Filesize
28KB

Download