b77c9868fe8283f2eff9cefc327b9f0625f9a75265235521a28c5940ee040450

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 04:09

Target
客户端工具/ClientMgr.exe
Size 2.3MB
Sample240314-eqt2vaab2z
SHA256 0bdfcdcc853dbe3ce8d17c63b5484ca40ca2eb7501e547f705e7be7f248b4ebe
MD5 b1c8b57f0e91beadc469d33402356214
SHA1 84551580a86511a1ce8d4fbe788f3400a3534126
SHA512 3f2d8f4e102a3916643ed088edf97e4106bb64ccde66754c6d7f52fd89abadf9d2ccc43da33e2bedd9e2d15c2e31404c37dd91ec66303fa41900adcf9a5061a9
SSDEEP 49152:zljq3t7AWyFUZql49J2h6h3d+GYDWPt/KEieWrIipH/TYM8nf0F2t:xjAUFbKEhcQiiHeAIiF/0Mofw2
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2844	ClientMgr.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Suspicious use of SendNotifyMessage 5 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2356	2844	ClientMgr.exe	28
PID 2844 wrote to memory of 2356	2844	ClientMgr.exe	28
PID 2844 wrote to memory of 2356	2844	ClientMgr.exe	28
PID 2844 wrote to memory of 2356	2844	ClientMgr.exe	28

memory/2844-0-0x00000000011F0000-0x00000000015EE000-memory.dmp

Download

memory/2844-1-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/2844-3-0x0000000000400000-0x0000000000F50000-memory.dmp

Download

memory/2844-4-0x00000000011F0000-0x00000000015EE000-memory.dmp

Download

memory/2844-7-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/2844-9-0x00000000011F0000-0x00000000015EE000-memory.dmp

Download