089fa75d9d15b2c8abbaf0daf126b72c8e22dbddb31f56e50f4a19c90065b10f

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 15:24

Target
AWB NO. 077-57676135055.exe
Size 1.1MB
Sample240703-ss2rcswajb
SHA256 089fa75d9d15b2c8abbaf0daf126b72c8e22dbddb31f56e50f4a19c90065b10f
MD5 d0aa9dae95ef6311340a157817230bf0
SHA1 80019b077b5c1ded0b6485443100c66e94d92e3a
SHA512 db4f9fbef67a609c385c84200f943cd1613122711130a1d2ae04dcece7b156b9df64c22230934cc44b358ac5c4357f406afd06c696db198fc7dafa603a852890
SSDEEP 24576:3AHnh+eWsN3skA4RV1Hom2KXMmHah+tMVkGWioush1i75:qh+ZkldoPK8Yah++DWDu
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1572 set thread context of 2576	1572	AWB NO. 077-57676135055.exe	28

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1572	AWB NO. 077-57676135055.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1572	AWB NO. 077-57676135055.exe
1572	AWB NO. 077-57676135055.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1572	AWB NO. 077-57676135055.exe
1572	AWB NO. 077-57676135055.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 2576	1572	AWB NO. 077-57676135055.exe	28
PID 1572 wrote to memory of 2576	1572	AWB NO. 077-57676135055.exe	28
PID 1572 wrote to memory of 2576	1572	AWB NO. 077-57676135055.exe	28
PID 1572 wrote to memory of 2576	1572	AWB NO. 077-57676135055.exe	28
PID 1572 wrote to memory of 2576	1572	AWB NO. 077-57676135055.exe	28

C:\Users\Admin\AppData\Local\Temp\AWB NO. 077-57676135055.exe
"C:\Users\Admin\AppData\Local\Temp\AWB NO. 077-57676135055.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\AWB NO. 077-57676135055.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2576

acceptancy

Path C:\Users\Admin\AppData\Local\Temp\acceptancy
Size 279KB
SHA256 20a7818ab406dc49055b355f60fdf7f70687c2090ffbdddde2e346e543bb5776
MD5 269f6a1274a6b8ccb02a4a704f7b16af
SHA1 d5e926f5213fbec4c8e285eda22eafe920822646
SHA512 f4edef7f71b285f3904a8beafaef35c3dae6f5cd812025f4fe9e3bd7ee2ad51fae068a5ddbbb9e3ecd0f9d574facfd0a1cca5b250896cf50b52b3ec62094ac1e
SSDEEP 6144:uwkTDIirbOKJhK54lLH70h/AiC2gCryJtTdYL7owG+8tEw:bwxRhU4x8tnmJbW7oAoEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1572-11-0x00000000001A0000-0x00000000001A4000-memory.dmp

Download

memory/2576-12-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/2576-13-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/2576-15-0x00000000007B0000-0x0000000000AB3000-memory.dmp

Download

memory/2576-14-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/2576-16-0x0000000000400000-0x0000000000446000-memory.dmp

Download