3e7ca8ac2382993641497e1ef8befb23c318bc1295bad8ada496bcf80ba9c568

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 17:44

Target

3e7ca8ac2382993641497e1ef8befb23c318bc1295bad8ada496bcf80ba9c568.exe
Size

27.7MB
MD5

8070f6374c85c3ef486c86beaa0f0b5c
SHA1

8e901b967e7fc7eee225da66e8ce87e75a9f9a99
SHA256

3e7ca8ac2382993641497e1ef8befb23c318bc1295bad8ada496bcf80ba9c568
SHA512

c01cd91cb5b8ca9b2b97f5778ea3923974734135306966ea07a2265b21fbcb1d858de58af5e13cfba2597340eb9ab7472545de53d063d58b4c7034515f531032
SSDEEP

393216:JtbrFR5f5JWsPSl0l+DmVGauCZsoj3mT/tojNfIDpRfGgtcZq4:bt3WOSClSmVIdoj3w/tojyDDfrcZq

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3032	3e7ca8ac2382993641497e1ef8befb23c318bc1295bad8ada496bcf80ba9c568.exe
3032	3e7ca8ac2382993641497e1ef8befb23c318bc1295bad8ada496bcf80ba9c568.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3032	3e7ca8ac2382993641497e1ef8befb23c318bc1295bad8ada496bcf80ba9c568.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2648	3032	3e7ca8ac2382993641497e1ef8befb23c318bc1295bad8ada496bcf80ba9c568.exe	30
PID 3032 wrote to memory of 2648	3032	3e7ca8ac2382993641497e1ef8befb23c318bc1295bad8ada496bcf80ba9c568.exe	30
PID 3032 wrote to memory of 2648	3032	3e7ca8ac2382993641497e1ef8befb23c318bc1295bad8ada496bcf80ba9c568.exe	30

C:\Users\Admin\AppData\Local\Temp\3e7ca8ac2382993641497e1ef8befb23c318bc1295bad8ada496bcf80ba9c568.exe
"C:\Users\Admin\AppData\Local\Temp\3e7ca8ac2382993641497e1ef8befb23c318bc1295bad8ada496bcf80ba9c568.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3032 -s 168
  2⤵
  PID:2648

memory/3032-0-0x0000000140117000-0x000000014116A000-memory.dmp

Filesize
16.3MB

Download
memory/3032-1-0x00000000777A0000-0x00000000777A2000-memory.dmp

Filesize
8KB

Download
memory/3032-3-0x00000000777A0000-0x00000000777A2000-memory.dmp

Filesize
8KB

Download
memory/3032-10-0x00000000777D0000-0x00000000777D2000-memory.dmp

Filesize
8KB

Download
memory/3032-8-0x00000000777D0000-0x00000000777D2000-memory.dmp

Filesize
8KB

Download
memory/3032-6-0x00000000777D0000-0x00000000777D2000-memory.dmp

Filesize
8KB

Download
memory/3032-5-0x00000000777A0000-0x00000000777A2000-memory.dmp

Filesize
8KB

Download
memory/3032-11-0x000000013FFF0000-0x0000000142D17000-memory.dmp

Filesize
45.2MB

Download
memory/3032-15-0x000000013FFF0000-0x0000000142D17000-memory.dmp

Filesize
45.2MB

Download
memory/3032-16-0x0000000140117000-0x000000014116A000-memory.dmp

Filesize
16.3MB

Download