6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 01:21

Target

6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe
Size

3.4MB
MD5

1e39051f272c9dd66693fcc1ae6aee05
SHA1

f60504bcff01280c4526b021bd6c111497122adb
SHA256

6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca
SHA512

f86346021d53ac75dd953d7a5556b81b8b79ebafbd0ef21902a27da903f87e8e140402e5cf97564c35c1fe187699649be949de32f0fcf0de3a8af942e96debbd
SSDEEP

98304:17+LSnP94zHiut+bGAbqILvyx0L332Wmcg/Q:aSyz7AblvyWz14

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2112	6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe
2112	6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2112	6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe
2112	6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe
2112	6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe
2112	6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe
2112	6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe
2112	6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe
2112	6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe
2112	6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2760	2112	6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe	31
PID 2112 wrote to memory of 2760	2112	6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe	31
PID 2112 wrote to memory of 2760	2112	6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe	31
PID 2112 wrote to memory of 2760	2112	6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe	31

C:\Users\Admin\AppData\Local\Temp\6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe
"C:\Users\Admin\AppData\Local\Temp\6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe"
  2⤵
  PID:2760

memory/2112-20-0x000000013F3E0000-0x00000001403ED000-memory.dmp

Filesize
16.1MB

Download
memory/2112-23-0x0000000077BA0000-0x0000000077D49000-memory.dmp

Filesize
1.7MB

Download
memory/2112-4-0x0000000077BA0000-0x0000000077D49000-memory.dmp

Filesize
1.7MB

Download
memory/2112-3-0x0000000077BF1000-0x0000000077BF2000-memory.dmp

Filesize
4KB

Download
memory/2112-2-0x000000013F3E0000-0x00000001403ED000-memory.dmp

Filesize
16.1MB

Download
memory/2112-21-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2112-0-0x000000013F3E0000-0x00000001403ED000-memory.dmp

Filesize
16.1MB

Download
memory/2112-1-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2760-22-0x0000000077BA0000-0x0000000077D49000-memory.dmp

Filesize
1.7MB

Download
memory/2760-19-0x0000000000050000-0x0000000000056000-memory.dmp

Filesize
24KB

Download
memory/2760-24-0x0000000077BA0000-0x0000000077D49000-memory.dmp

Filesize
1.7MB

Download
memory/2760-25-0x0000000077BA0000-0x0000000077D49000-memory.dmp

Filesize
1.7MB

Download
memory/2760-26-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/2760-28-0x0000000077BA0000-0x0000000077D49000-memory.dmp

Filesize
1.7MB

Download
memory/2760-27-0x0000000077BA0000-0x0000000077D49000-memory.dmp

Filesize
1.7MB

Download
memory/2760-29-0x0000000077BA0000-0x0000000077D49000-memory.dmp

Filesize
1.7MB

Download