d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a

Analysis

max time kernel
151s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 07:55

Target

d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe
Size

68KB
MD5

6faa2e319a42288353593505a6f99b32
SHA1

8a79c335aa6464ae1419c1a4aa00edd3001e1417
SHA256

d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a
SHA512

992226a0007e4691836eab62f10b77746f0e3562db231cda3a2db1495a08ec04691918f363835419df92eccddf9629cd105e9b0a1cbdc869b336427f925a8572
SSDEEP

1536:w/MC6e4ikK4UKgiMqQSEq0+o20Ww2mps:PC6e4ikK4UKgiMqQSEq0+o20Ww23

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\New Folder (2).exe	d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe
File opened for modification	\??\c:\windows\New Folder (2).exe	d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2084	d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2732	2084	d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe	80
PID 2084 wrote to memory of 2732	2084	d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe	80

C:\Users\Admin\AppData\Local\Temp\d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe
"C:\Users\Admin\AppData\Local\Temp\d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- \??\c:\windows\explorer.exe
  c:\windows\explorer.exe
  2⤵
  - Modifies registry class
  PID:2732

memory/2084-132-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2084-136-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download