6961493faf2300d1c9a8d20e2591de4bb93fe7ed12f670ed9fc3b36dced0b0e0

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 05:50

Target

VirusShare_7c9bfec0c0f1756c76088a45b157148e.exe
Size

114KB
MD5

7c9bfec0c0f1756c76088a45b157148e
SHA1

9749f96d916391ee6192a1ff447e7dd5d16f81c4
SHA256

6961493faf2300d1c9a8d20e2591de4bb93fe7ed12f670ed9fc3b36dced0b0e0
SHA512

a3488fe479030823aecc0688cea77812e1bd640893066e11e22e9846a9cd0904e2dff8066f8ac6055267d08d8cae3874a96c0b168eb35336636b869c730ee623
SSDEEP

1536:XRxPpeiFPoBh6YVTZfDJqiA69+4iaoGSRL6G3DvTdr1Ny:hxPpeiFPoBh6gBDpAr5aoNHLP0

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2340 set thread context of 2884	2340	VirusShare_7c9bfec0c0f1756c76088a45b157148e.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2340	VirusShare_7c9bfec0c0f1756c76088a45b157148e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2884	2340	VirusShare_7c9bfec0c0f1756c76088a45b157148e.exe	28
PID 2340 wrote to memory of 2884	2340	VirusShare_7c9bfec0c0f1756c76088a45b157148e.exe	28
PID 2340 wrote to memory of 2884	2340	VirusShare_7c9bfec0c0f1756c76088a45b157148e.exe	28
PID 2340 wrote to memory of 2884	2340	VirusShare_7c9bfec0c0f1756c76088a45b157148e.exe	28
PID 2340 wrote to memory of 2884	2340	VirusShare_7c9bfec0c0f1756c76088a45b157148e.exe	28
PID 2340 wrote to memory of 2884	2340	VirusShare_7c9bfec0c0f1756c76088a45b157148e.exe	28
PID 2340 wrote to memory of 2884	2340	VirusShare_7c9bfec0c0f1756c76088a45b157148e.exe	28
PID 2340 wrote to memory of 2884	2340	VirusShare_7c9bfec0c0f1756c76088a45b157148e.exe	28

C:\Users\Admin\AppData\Local\Temp\VirusShare_7c9bfec0c0f1756c76088a45b157148e.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_7c9bfec0c0f1756c76088a45b157148e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\VirusShare_7c9bfec0c0f1756c76088a45b157148e.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_7c9bfec0c0f1756c76088a45b157148e.exe"
  2⤵
  PID:2884

memory/2884-2-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2884-4-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2884-5-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2884-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2884-9-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2884-11-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2884-15-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2884-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2884-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download