0d8350366ae41b08cbdc3bef85082c7de988bad53dc98f74863e8b3a362f1ece

Analysis

Target
7779f0c76c2d0ec2b4f6327e7ffa04ad.exe
Size 7.4MB
Sample210624-3m2v22mycs
SHA256 0d8350366ae41b08cbdc3bef85082c7de988bad53dc98f74863e8b3a362f1ece
MD5 7779f0c76c2d0ec2b4f6327e7ffa04ad
SHA1 a707278c4fac59e811816b8e93034b1b9ee28ecd
SHA512 dcecb5124db69ebc4f83c50d18747648c1e7b965c7d69367fa605b40f027a3576292c611255782943d1455504728982cfde7ae8992588bb57c04120ea251ac19
MD5 SHA1 SHA512

Score

7^/10

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7779f0c76c2d0ec2b4f6327e7ffa04ad.exe	7779f0c76c2d0ec2b4f6327e7ffa04ad.exe

Loads dropped DLL 19 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2196	7779f0c76c2d0ec2b4f6327e7ffa04ad.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 2196	912	7779f0c76c2d0ec2b4f6327e7ffa04ad.exe	71
PID 912 wrote to memory of 2196	912	7779f0c76c2d0ec2b4f6327e7ffa04ad.exe	71
PID 2196 wrote to memory of 204	2196	7779f0c76c2d0ec2b4f6327e7ffa04ad.exe	76
PID 2196 wrote to memory of 204	2196	7779f0c76c2d0ec2b4f6327e7ffa04ad.exe	76

C:\Users\Admin\AppData\Local\Temp\7779f0c76c2d0ec2b4f6327e7ffa04ad.exe
"C:\Users\Admin\AppData\Local\Temp\7779f0c76c2d0ec2b4f6327e7ffa04ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\7779f0c76c2d0ec2b4f6327e7ffa04ad.exe
  "C:\Users\Admin\AppData\Local\Temp\7779f0c76c2d0ec2b4f6327e7ffa04ad.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:204