586f35406c4b5d27729f575e7712406494d4211bcd744f1023816fe2bd405112

Analysis

max time kernel
141s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 09:49

Target

586f35406c4b5d27729f575e7712406494d4211bcd744f1023816fe2bd405112.exe
Size

547KB
MD5

dbf4493c9076a4f710cd477558931219
SHA1

00b8555872b10fb8828fe77572a86f795761179a
SHA256

586f35406c4b5d27729f575e7712406494d4211bcd744f1023816fe2bd405112
SHA512

50862e5662ff54b2bfac8346bec5ebc715b178a8fd5076163c5e92e9ef2595bc7f4858b727a48d3243d22bbda08d6a57914cccdfc6195a048371427e2bdf831b
SSDEEP

12288:37ePU062CT7Wd/2HJgxnbni8V9YxX9L1DODx+bWtj:rUSaSmbi8nWX9ZDOYWZ

Score

1^/10

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinTopoProject	586f35406c4b5d27729f575e7712406494d4211bcd744f1023816fe2bd405112.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinTopoProject\ = "WinTopo ??"	586f35406c4b5d27729f575e7712406494d4211bcd744f1023816fe2bd405112.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinTopoProject\shell\open\ddeexec	586f35406c4b5d27729f575e7712406494d4211bcd744f1023816fe2bd405112.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinTopoProject\shell	586f35406c4b5d27729f575e7712406494d4211bcd744f1023816fe2bd405112.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinTopoProject\shell\open	586f35406c4b5d27729f575e7712406494d4211bcd744f1023816fe2bd405112.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinTopoProject\shell\open\ddeexec\ = "[open(\"%1\")]"	586f35406c4b5d27729f575e7712406494d4211bcd744f1023816fe2bd405112.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinTopoProject\shell\open\command	586f35406c4b5d27729f575e7712406494d4211bcd744f1023816fe2bd405112.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinTopoProject\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\586F35~1.EXE \"%1\""	586f35406c4b5d27729f575e7712406494d4211bcd744f1023816fe2bd405112.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1492	586f35406c4b5d27729f575e7712406494d4211bcd744f1023816fe2bd405112.exe
1492	586f35406c4b5d27729f575e7712406494d4211bcd744f1023816fe2bd405112.exe

memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1492-55-0x0000000000400000-0x000000000058C000-memory.dmp

Filesize
1.5MB

Download
memory/1492-56-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/1492-57-0x0000000000400000-0x000000000058C000-memory.dmp

Filesize
1.5MB

Download