7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37

Analysis

max time kernel
29s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 00:11

Target

7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
Size

292KB
MD5

620399ca3fa933940813332a6aa2d003
SHA1

838b5bf26b4b18bf7bf531164ad659771bcdb136
SHA256

7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37
SHA512

81c620b98ab7c179f5373d335472936209215133df9655166d276798069b0341fb51d59f7e2860839f92b67aeb9ed28bd019e915f0d533707ec6ebe8edd8c3f5

Score

4^/10

Drops file in Windows directory 1 IoCs

Processes:

7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe

description ioc process

File opened for modification C:\Windows\win.ini 7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe

pid	process
4432	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
5064	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe

description	pid	process	target process
PID 4432 wrote to memory of 5064	4432	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
PID 4432 wrote to memory of 5064	4432	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
PID 4432 wrote to memory of 5064	4432	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe

C:\Users\Admin\AppData\Local\Temp\7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
"C:\Users\Admin\AppData\Local\Temp\7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:5064