a9316f6a418373e03b042491437a99b31fbf3ac36331c2afdf7e9b703740868a

Analysis

max time kernel
65s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2022, 15:53

Target

a9316f6a418373e03b042491437a99b31fbf3ac36331c2afdf7e9b703740868a.exe
Size

1.9MB
MD5

61633c172fb1e37e148d6a5958539ca1
SHA1

946c666d3f64a62f29c4d46c550749e0727a906d
SHA256

a9316f6a418373e03b042491437a99b31fbf3ac36331c2afdf7e9b703740868a
SHA512

cbf4a4c041225e43844bd71615bd577eb619aae2f6888c42f4591cc76ea04640c8ec69839553f339bbdc499b306650887d07b4b9854975755fcfc1cefa5075e4
SSDEEP

49152:WTE+ECKHktf13GZJEzviuZFegsI2b9E6Ex9VKVKzqME4sYU:qvektIq1ZEK64VKVK24sN

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\syys6.1.2.syw	a9316f6a418373e03b042491437a99b31fbf3ac36331c2afdf7e9b703740868a.exe
File opened for modification	\??\c:\windows\SysWOW64\opfileOneA	a9316f6a418373e03b042491437a99b31fbf3ac36331c2afdf7e9b703740868a.exe
File created	\??\c:\windows\SysWOW64\opfileOneA	a9316f6a418373e03b042491437a99b31fbf3ac36331c2afdf7e9b703740868a.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\EditFlags = "65536"	a9316f6a418373e03b042491437a99b31fbf3ac36331c2afdf7e9b703740868a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.8\EditFlags = "65536"	a9316f6a418373e03b042491437a99b31fbf3ac36331c2afdf7e9b703740868a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerPoint.Show.8\EditFlags = "65536"	a9316f6a418373e03b042491437a99b31fbf3ac36331c2afdf7e9b703740868a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile	a9316f6a418373e03b042491437a99b31fbf3ac36331c2afdf7e9b703740868a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile\isogg = "alrGady"	a9316f6a418373e03b042491437a99b31fbf3ac36331c2afdf7e9b703740868a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8	a9316f6a418373e03b042491437a99b31fbf3ac36331c2afdf7e9b703740868a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3440	a9316f6a418373e03b042491437a99b31fbf3ac36331c2afdf7e9b703740868a.exe
3440	a9316f6a418373e03b042491437a99b31fbf3ac36331c2afdf7e9b703740868a.exe

memory/3440-132-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/3440-133-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download