0058b4f69b0e6b9fc2eaca10a9bfb41e72e6cd72a827f8740fefde876194bade

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2022, 02:29

Target

PowerISO/App/PowerISO64/piso.exe
Size

19KB
MD5

9360b0fd9463c76cba81354c326175c5
SHA1

7027b3a3db85a25a691903fc53db326304ca6ec8
SHA256

1afd8476e416214600debd419d35ac3674b2d9010daae580ed5052c4b7b0b3d4
SHA512

3da6870320c7052e383fc92a5c5277e3976dcbf48f1d22abbae62fee0d9d2219b4cfa75f4808d9a4eee842d1b5da9dc8c06836e78bf240972d5b28daa77f49c2
SSDEEP

384:SXhgKsW4z7VCI8JN77hh++Vql8JN77hhTW:GWK2z7V+3hA+VqC3hJW

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8658416-7CCB-4c1d-A021-AFF0A2EB8004}	PowerISO.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1536	PowerISO.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 1536	4496	piso.exe	83
PID 4496 wrote to memory of 1536	4496	piso.exe	83

C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64\piso.exe
"C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64\piso.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64\PowerISO.exe
  C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64\PowerISO.exe -wd "C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64"
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1536