7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47

Analysis

max time kernel
136s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 10:42

Target

7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47.exe
Size

36KB
MD5

6d310f21236ebc015734ad95c528c9e2
SHA1

fc640d3c93e7ef8e2214ce07e85b54e57c163310
SHA256

7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47
SHA512

e54697eeda64aece35a4a98ac588c536f247154c8f818deaf0cbe547975488603cd28cf87e49a7eeebebfd3b6020ab7d3fa97e13b071b67661df3afc9b364d6c
SSDEEP

768:ZcmtTXM2YZU9ZFOjLFyaBpBoy8KDbZS2nCyH5UmZ:OyTXU29ZwcAHokZXnCyH5

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4180	qtvwwz.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\qtvwwz.exe	7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47.exe
File opened for modification	C:\Windows\SysWOW64\qtvwwz.exe	7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4180 set thread context of 4460	4180	qtvwwz.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4748	4460	WerFault.exe	82

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3020	7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3020	7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47.exe
3020	7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47.exe
4180	qtvwwz.exe
4180	qtvwwz.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 4460	4180	qtvwwz.exe	82
PID 4180 wrote to memory of 4460	4180	qtvwwz.exe	82
PID 4180 wrote to memory of 4460	4180	qtvwwz.exe	82
PID 4180 wrote to memory of 4460	4180	qtvwwz.exe	82
PID 4180 wrote to memory of 4460	4180	qtvwwz.exe	82

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4460 -ip 4460
1⤵
PID:1824

C:\Windows\SysWOW64\qtvwwz.exe

Filesize
36KB

MD5
6d310f21236ebc015734ad95c528c9e2

SHA1
fc640d3c93e7ef8e2214ce07e85b54e57c163310

SHA256
7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47

SHA512
e54697eeda64aece35a4a98ac588c536f247154c8f818deaf0cbe547975488603cd28cf87e49a7eeebebfd3b6020ab7d3fa97e13b071b67661df3afc9b364d6c

Download Submit
C:\Windows\SysWOW64\qtvwwz.exe

Filesize
36KB

MD5
6d310f21236ebc015734ad95c528c9e2

SHA1
fc640d3c93e7ef8e2214ce07e85b54e57c163310

SHA256
7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47

SHA512
e54697eeda64aece35a4a98ac588c536f247154c8f818deaf0cbe547975488603cd28cf87e49a7eeebebfd3b6020ab7d3fa97e13b071b67661df3afc9b364d6c

Download Submit
memory/4460-135-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download