0dadd3a064fff7fcebb10ac55cd54d7b366f136d111d6da4a0da85b7cbf4c170

Analysis

max time kernel
91s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 10:50

Target

0dadd3a064fff7fcebb10ac55cd54d7b366f136d111d6da4a0da85b7cbf4c170.exe
Size

277KB
MD5

6831b7dfcd602de79d8b7f4e1bb6aae4
SHA1

8ca185e99d448d3da4ed67edc78390c8934264da
SHA256

0dadd3a064fff7fcebb10ac55cd54d7b366f136d111d6da4a0da85b7cbf4c170
SHA512

f2cad7c8ee9a77ce5b412b60a1347f5965febda4700d010d995831b86317ff380d62e16d4632d0cc06ea24f3004771ce37c513b4403c30ed050aaabebabb1d16
SSDEEP

6144:zJmv47AdtfZ5WSAZC8UdwLZsm0ohoymEGB5NA:37AdNLZAZDUdcsm0oV

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	calc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4932	0dadd3a064fff7fcebb10ac55cd54d7b366f136d111d6da4a0da85b7cbf4c170.exe
4932	0dadd3a064fff7fcebb10ac55cd54d7b366f136d111d6da4a0da85b7cbf4c170.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5052	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1880	4932	0dadd3a064fff7fcebb10ac55cd54d7b366f136d111d6da4a0da85b7cbf4c170.exe	82
PID 4932 wrote to memory of 1880	4932	0dadd3a064fff7fcebb10ac55cd54d7b366f136d111d6da4a0da85b7cbf4c170.exe	82

C:\Users\Admin\AppData\Local\Temp\0dadd3a064fff7fcebb10ac55cd54d7b366f136d111d6da4a0da85b7cbf4c170.exe
"C:\Users\Admin\AppData\Local\Temp\0dadd3a064fff7fcebb10ac55cd54d7b366f136d111d6da4a0da85b7cbf4c170.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  PID:1880

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5052

memory/4932-132-0x00007FF90B5F0000-0x00007FF90B7E5000-memory.dmp

Filesize
2.0MB

Download
memory/4932-133-0x00007FF909930000-0x00007FF9099DC000-memory.dmp

Filesize
688KB

Download
memory/4932-135-0x00007FF90B5F0000-0x00007FF90B7E5000-memory.dmp

Filesize
2.0MB

Download