c2665fba74639ef06eb629bc5e2d869edaab8cdbee341472912444bf92cfb5af

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 21:47

Target

c2665fba74639ef06eb629bc5e2d869edaab8cdbee341472912444bf92cfb5af.exe
Size

710KB
MD5

a0f10c30c495ad25c3a531c1c3a062f0
SHA1

25c7191a399b6f3061b7a83e88f5fb4f1049eb30
SHA256

c2665fba74639ef06eb629bc5e2d869edaab8cdbee341472912444bf92cfb5af
SHA512

58ac8b432f1325960d0ba808a7c0acf213c96c11c949960336c9e0d3cb6130d510cc0cf4ffb97a06471634420a3cb04264b40010d645f3a649029c13f87accc0
SSDEEP

6144:Qf6vhUNIPcmmmRm4EG76adSNc/B9XgGJ2FN6SSSB:msEmREGO8oc/B9Q/6SSSB

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3516	new_400ai.exe_0CD25E66B4D3F39A0F8EE29AEF7F96A9296E865D.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3516	new_400ai.exe_0CD25E66B4D3F39A0F8EE29AEF7F96A9296E865D.exe
3516	new_400ai.exe_0CD25E66B4D3F39A0F8EE29AEF7F96A9296E865D.exe
3516	new_400ai.exe_0CD25E66B4D3F39A0F8EE29AEF7F96A9296E865D.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3516	new_400ai.exe_0CD25E66B4D3F39A0F8EE29AEF7F96A9296E865D.exe
3516	new_400ai.exe_0CD25E66B4D3F39A0F8EE29AEF7F96A9296E865D.exe
3516	new_400ai.exe_0CD25E66B4D3F39A0F8EE29AEF7F96A9296E865D.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 3516	3752	c2665fba74639ef06eb629bc5e2d869edaab8cdbee341472912444bf92cfb5af.exe	84
PID 3752 wrote to memory of 3516	3752	c2665fba74639ef06eb629bc5e2d869edaab8cdbee341472912444bf92cfb5af.exe	84
PID 3752 wrote to memory of 3516	3752	c2665fba74639ef06eb629bc5e2d869edaab8cdbee341472912444bf92cfb5af.exe	84

C:\Users\Admin\AppData\Local\Temp\c2665fba74639ef06eb629bc5e2d869edaab8cdbee341472912444bf92cfb5af.exe
"C:\Users\Admin\AppData\Local\Temp\c2665fba74639ef06eb629bc5e2d869edaab8cdbee341472912444bf92cfb5af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Users\Admin\AppData\Local\Temp\new_400ai.exe_0CD25E66B4D3F39A0F8EE29AEF7F96A9296E865D.exe
  "C:\Users\Admin\AppData\Local\Temp\new_400ai.exe_0CD25E66B4D3F39A0F8EE29AEF7F96A9296E865D.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3516

C:\Users\Admin\AppData\Local\Temp\new_400ai.exe_0CD25E66B4D3F39A0F8EE29AEF7F96A9296E865D.exe

Filesize
252KB

MD5
9b07dfe42e631f6fe905affe27b816a1

SHA1
6505ce70d718f2125a4eac57f9a4aca5137f99dd

SHA256
2b5331308dfff885d62e3da03a32570b347ade8c4678214bab55af32f4167f2f

SHA512
a61986926655e4d98916d904f301a5ff9c4d8ae7c633904705d2da3f4f162a637e78efb0e5e93af4a5e2e638ab018f951881d0fb9a51773b5d520d12bc78b5c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\new_400ai.exe_0CD25E66B4D3F39A0F8EE29AEF7F96A9296E865D.exe

Filesize
252KB

MD5
9b07dfe42e631f6fe905affe27b816a1

SHA1
6505ce70d718f2125a4eac57f9a4aca5137f99dd

SHA256
2b5331308dfff885d62e3da03a32570b347ade8c4678214bab55af32f4167f2f

SHA512
a61986926655e4d98916d904f301a5ff9c4d8ae7c633904705d2da3f4f162a637e78efb0e5e93af4a5e2e638ab018f951881d0fb9a51773b5d520d12bc78b5c2

Download Submit
memory/3516-137-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3752-135-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download