81906bcd129a67f464efeb04ea9f84c9e4a3aef54ff29f2598665db62fc2c8ad

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 11:59

Target

d373a70df0ddba4cfd11db9ed7ec8df8.exe
Size

100KB
MD5

d373a70df0ddba4cfd11db9ed7ec8df8
SHA1

f65c2d2b2836e324b5f018d7e5d1caba08f4a006
SHA256

81906bcd129a67f464efeb04ea9f84c9e4a3aef54ff29f2598665db62fc2c8ad
SHA512

613968875e3746008a41c086c9cb9f1ef950e5cfd04b55e8f708a26db9deb62b01ded046090c0b93c2ede76646b18a70a50bf8f8c13937b876a2760321808308
SSDEEP

1536:rozr199csfPF7dAi1ssE+ALfd58d0xT7Ps2EMoAx3rqwwEyW9:roP9csHFJAussEJfd5a7M5x9

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 1872	2148	d373a70df0ddba4cfd11db9ed7ec8df8.exe	28

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2148	d373a70df0ddba4cfd11db9ed7ec8df8.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1872	2148	d373a70df0ddba4cfd11db9ed7ec8df8.exe	28
PID 2148 wrote to memory of 1872	2148	d373a70df0ddba4cfd11db9ed7ec8df8.exe	28
PID 2148 wrote to memory of 1872	2148	d373a70df0ddba4cfd11db9ed7ec8df8.exe	28
PID 2148 wrote to memory of 1872	2148	d373a70df0ddba4cfd11db9ed7ec8df8.exe	28
PID 2148 wrote to memory of 1872	2148	d373a70df0ddba4cfd11db9ed7ec8df8.exe	28
PID 2148 wrote to memory of 1872	2148	d373a70df0ddba4cfd11db9ed7ec8df8.exe	28
PID 2148 wrote to memory of 1872	2148	d373a70df0ddba4cfd11db9ed7ec8df8.exe	28
PID 2148 wrote to memory of 1872	2148	d373a70df0ddba4cfd11db9ed7ec8df8.exe	28
PID 2148 wrote to memory of 1872	2148	d373a70df0ddba4cfd11db9ed7ec8df8.exe	28

C:\Users\Admin\AppData\Local\Temp\d373a70df0ddba4cfd11db9ed7ec8df8.exe
"C:\Users\Admin\AppData\Local\Temp\d373a70df0ddba4cfd11db9ed7ec8df8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\d373a70df0ddba4cfd11db9ed7ec8df8.exe
  "C:\Users\Admin\AppData\Local\Temp\d373a70df0ddba4cfd11db9ed7ec8df8.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1872

memory/1872-2-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1872-4-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1872-5-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1872-6-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download