0058b4f69b0e6b9fc2eaca10a9bfb41e72e6cd72a827f8740fefde876194bade

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-09-2022 02:29

Target

PowerISO/App/PowerISO64/piso.exe
Size

19KB
MD5

9360b0fd9463c76cba81354c326175c5
SHA1

7027b3a3db85a25a691903fc53db326304ca6ec8
SHA256

1afd8476e416214600debd419d35ac3674b2d9010daae580ed5052c4b7b0b3d4
SHA512

3da6870320c7052e383fc92a5c5277e3976dcbf48f1d22abbae62fee0d9d2219b4cfa75f4808d9a4eee842d1b5da9dc8c06836e78bf240972d5b28daa77f49c2
SSDEEP

384:SXhgKsW4z7VCI8JN77hh++Vql8JN77hhTW:GWK2z7V+3hA+VqC3hJW

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8658416-7CCB-4c1d-A021-AFF0A2EB8004}	PowerISO.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1984	PowerISO.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1984	784	piso.exe	27
PID 784 wrote to memory of 1984	784	piso.exe	27
PID 784 wrote to memory of 1984	784	piso.exe	27
PID 784 wrote to memory of 1984	784	piso.exe	27

C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64\piso.exe
"C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64\piso.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64\PowerISO.exe
  C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64\PowerISO.exe -wd "C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64"
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1984

memory/1984-54-0x0000000000000000-mapping.dmp

Download
memory/1984-55-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

Filesize
8KB

Download