c57d43fc6e69e16fb28ead676881a2eaccc7d64fd55f02fb7ba0146d9b94745a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 11:30

Target

cb4b632186957707135a40a2cc1fdaa7.exe
Size

250KB
MD5

cb4b632186957707135a40a2cc1fdaa7
SHA1

277341eeda6ea3148997d9bf1df91bf6f4046bb7
SHA256

c57d43fc6e69e16fb28ead676881a2eaccc7d64fd55f02fb7ba0146d9b94745a
SHA512

31937500b08d4c111942e92c0a79fa471fdb95dfbc941cdba58cd3bc644c52e66865d07bcf6ea77d5ad9c335df6c547676ee27a06f1dffe6c5a2d3889083e78a
SSDEEP

3072:mN6jJE4iM6wsdPLGBG2Ox+7umxab8SbNf1KeY90RnEzb9InSEHDu0i9SG9uuwhPO:Q6jJ3D3MGBG2F5AKeA0b2PArs9q5W

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2992 set thread context of 2872	2992	cb4b632186957707135a40a2cc1fdaa7.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2872	cb4b632186957707135a40a2cc1fdaa7.exe
2872	cb4b632186957707135a40a2cc1fdaa7.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2992	cb4b632186957707135a40a2cc1fdaa7.exe
2992	cb4b632186957707135a40a2cc1fdaa7.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2872	2992	cb4b632186957707135a40a2cc1fdaa7.exe	28
PID 2992 wrote to memory of 2872	2992	cb4b632186957707135a40a2cc1fdaa7.exe	28
PID 2992 wrote to memory of 2872	2992	cb4b632186957707135a40a2cc1fdaa7.exe	28
PID 2992 wrote to memory of 2872	2992	cb4b632186957707135a40a2cc1fdaa7.exe	28
PID 2992 wrote to memory of 2872	2992	cb4b632186957707135a40a2cc1fdaa7.exe	28
PID 2992 wrote to memory of 2872	2992	cb4b632186957707135a40a2cc1fdaa7.exe	28
PID 2992 wrote to memory of 2872	2992	cb4b632186957707135a40a2cc1fdaa7.exe	28
PID 2992 wrote to memory of 2872	2992	cb4b632186957707135a40a2cc1fdaa7.exe	28
PID 2872 wrote to memory of 1192	2872	cb4b632186957707135a40a2cc1fdaa7.exe	21
PID 2872 wrote to memory of 1192	2872	cb4b632186957707135a40a2cc1fdaa7.exe	21
PID 2872 wrote to memory of 1192	2872	cb4b632186957707135a40a2cc1fdaa7.exe	21
PID 2872 wrote to memory of 1192	2872	cb4b632186957707135a40a2cc1fdaa7.exe	21
PID 2872 wrote to memory of 1192	2872	cb4b632186957707135a40a2cc1fdaa7.exe	21
PID 2872 wrote to memory of 1192	2872	cb4b632186957707135a40a2cc1fdaa7.exe	21

memory/1192-18-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1192-24-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/2872-16-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2872-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2872-37-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2872-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2872-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2992-10-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2992-8-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2992-4-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2992-5-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2992-13-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2992-0-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2992-2-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2992-1-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2992-6-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download