934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 01:33

Target

934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe
Size

1.1MB
MD5

b05203ce620abcf84ff7acb68ce49e8e
SHA1

39b0c3f649afe2e6d6e4fc4fa343e9dd19d2d66c
SHA256

934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7
SHA512

c5a33fc60b5d56844815e711e6567018cbbcb948f003d3e4406e42b498f318e75701d7e59b4ea350b7d0d8aa6158f8b68a51f229596bcb02dd161f234931ff8a
SSDEEP

24576:SAHnh+eWsN3skA4RV1Hom2KXMmHacuEoUsJ+/MM35:Vh+ZkldoPK8YacWUs8kI

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1988 set thread context of 3048	1988	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe	31

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1988	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1988	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe
1988	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1988	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe
1988	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 3048	1988	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe	31
PID 1988 wrote to memory of 3048	1988	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe	31
PID 1988 wrote to memory of 3048	1988	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe	31
PID 1988 wrote to memory of 3048	1988	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe	31
PID 1988 wrote to memory of 3048	1988	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe	31

C:\Users\Admin\AppData\Local\Temp\934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe
"C:\Users\Admin\AppData\Local\Temp\934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048

C:\Users\Admin\AppData\Local\Temp\Esher

Filesize
266KB

MD5
adf8b93c02082284280964f34d978a79

SHA1
258a804a7ce60dda487a0a9d62dfe96b73bd836b

SHA256
9606494cf7e882ba4654d06ae2dafb00793268b6ecbecac74e7245939c8d9e46

SHA512
3c991694eb63865af5e185df71852eb21bf83adf9208062ec9c5c9ecd68012b9efc10a9d24ea350f74c5a3ad70d40296679d742ba89e738d701af42e88747293

Download Submit
memory/1988-11-0x0000000000160000-0x0000000000164000-memory.dmp

Filesize
16KB

Download
memory/3048-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3048-13-0x0000000000A40000-0x0000000000D43000-memory.dmp

Filesize
3.0MB

Download
memory/3048-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3048-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download