5bd645a7783a25d2caa48ee448ad1e47c00ae25e5a7fd9b304ad9422e9e79fd5

Analysis

Target
image.exe
Size 536KB
Sample200818-cxe43cv4te
SHA256 5bd645a7783a25d2caa48ee448ad1e47c00ae25e5a7fd9b304ad9422e9e79fd5
MD5 76430208466ca619a470ab10e9ce6848
SHA1 a7730a38f002dfe4e59a26ec2cc46fdc422e2708
SHA512 cad3a9d15632488ad418e17472215199630910f9adeb5d076e7a38c95b8b8e06fbe8263b9a3e2853e84b18e3754fc58ffb01717e845ffdf48fecdb397e92c22b
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
692	xpwpjjch.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xpwpjjch.exe	image.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xpwpjjch.exe	image.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 648	1520	image.exe	67
PID 1520 wrote to memory of 648	1520	image.exe	67
PID 1520 wrote to memory of 648	1520	image.exe	67
PID 1520 wrote to memory of 692	1520	image.exe	69
PID 1520 wrote to memory of 692	1520	image.exe	69
PID 1520 wrote to memory of 692	1520	image.exe	69

C:\Users\Admin\AppData\Local\Temp\image.exe
"C:\Users\Admin\AppData\Local\Temp\image.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:648
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xpwpjjch.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xpwpjjch.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:692