031f4e437f35f70a75de0150f32afd6b85ef2785dc61091b783f63124c661a8a

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 20:38

Target

orqur private.exe
Size

4.2MB
MD5

f2cfbd2044be6ba74865a13a1ecaa1e5
SHA1

a10cf96b3b9e7f891c4fd23ae240d2b61ab2e240
SHA256

031f4e437f35f70a75de0150f32afd6b85ef2785dc61091b783f63124c661a8a
SHA512

31e133b4f60df334c580452cf4ba8023f8ead15c3c1c1798aed0cf97a2aa74c81d1c9bfde6099cffffe3d8282e28cfa406056468f9488ef9305e0c60299ef5ae
SSDEEP

98304:3ZzS52Eh6JTMfW8DJW2n9pm9b4Hb3yxN5:l8h6JS/9D7C75

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
672	orqur private.exe
672	orqur private.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
672	orqur private.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 2744	672	orqur private.exe	31
PID 672 wrote to memory of 2744	672	orqur private.exe	31
PID 672 wrote to memory of 2744	672	orqur private.exe	31
PID 2744 wrote to memory of 2852	2744	cmd.exe	32
PID 2744 wrote to memory of 2852	2744	cmd.exe	32
PID 2744 wrote to memory of 2852	2744	cmd.exe	32
PID 2744 wrote to memory of 1168	2744	cmd.exe	33
PID 2744 wrote to memory of 1168	2744	cmd.exe	33
PID 2744 wrote to memory of 1168	2744	cmd.exe	33
PID 2744 wrote to memory of 2680	2744	cmd.exe	34
PID 2744 wrote to memory of 2680	2744	cmd.exe	34
PID 2744 wrote to memory of 2680	2744	cmd.exe	34

memory/672-0-0x000000013F4C2000-0x000000013F75B000-memory.dmp

Filesize
2.6MB

Download
memory/672-3-0x0000000076EB0000-0x0000000076EB2000-memory.dmp

Filesize
8KB

Download
memory/672-1-0x0000000076EB0000-0x0000000076EB2000-memory.dmp

Filesize
8KB

Download
memory/672-10-0x0000000076EE0000-0x0000000076EE2000-memory.dmp

Filesize
8KB

Download
memory/672-11-0x000000013F420000-0x000000013FB91000-memory.dmp

Filesize
7.4MB

Download
memory/672-8-0x0000000076EE0000-0x0000000076EE2000-memory.dmp

Filesize
8KB

Download
memory/672-6-0x0000000076EE0000-0x0000000076EE2000-memory.dmp

Filesize
8KB

Download
memory/672-5-0x0000000076EB0000-0x0000000076EB2000-memory.dmp

Filesize
8KB

Download
memory/672-16-0x000000013F420000-0x000000013FB91000-memory.dmp

Filesize
7.4MB

Download
memory/672-17-0x000000013F420000-0x000000013FB91000-memory.dmp

Filesize
7.4MB

Download
memory/672-18-0x000000013F420000-0x000000013FB91000-memory.dmp

Filesize
7.4MB

Download
memory/672-19-0x000000013F420000-0x000000013FB91000-memory.dmp

Filesize
7.4MB

Download
memory/672-20-0x000000013F420000-0x000000013FB91000-memory.dmp

Filesize
7.4MB

Download