625016c5204e2a963e472d4b6581d4c832137fc5a051b21cf39ba422d6a4f6e0

Analysis

max time kernel
111s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 21:20

Target

625016c5204e2a963e472d4b6581d4c832137fc5a051b21cf39ba422d6a4f6e0.exe
Size

919KB
MD5

c77967026ccd9d81ece516426f64acd2
SHA1

faf01bd21cc2c204e95a6e38792e67363d880a49
SHA256

625016c5204e2a963e472d4b6581d4c832137fc5a051b21cf39ba422d6a4f6e0
SHA512

1c08c2b6815086c4e1556a546748ef3b294a17dff8fb3b8d55f964297df69b07ae28c7bc734cc6d799cee2c312c36f510dde8ed6c93a4ad74f3646435cbbed67
SSDEEP

24576:FatKCHU+RYm5rJsHQz1H+XBJLnjP/kYaGtW:FiRtl1e3rjP/kGt

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4916	YShow3D.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4916	YShow3D.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 4916	444	625016c5204e2a963e472d4b6581d4c832137fc5a051b21cf39ba422d6a4f6e0.exe	28
PID 444 wrote to memory of 4916	444	625016c5204e2a963e472d4b6581d4c832137fc5a051b21cf39ba422d6a4f6e0.exe	28
PID 444 wrote to memory of 4916	444	625016c5204e2a963e472d4b6581d4c832137fc5a051b21cf39ba422d6a4f6e0.exe	28

C:\Users\Admin\AppData\Local\Temp\625016c5204e2a963e472d4b6581d4c832137fc5a051b21cf39ba422d6a4f6e0.exe
"C:\Users\Admin\AppData\Local\Temp\625016c5204e2a963e472d4b6581d4c832137fc5a051b21cf39ba422d6a4f6e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:444
- C:\Users\Admin\AppData\Local\Temp\YShow3D.exe
  C:\Users\Admin\AppData\Local\Temp\\YShow3D.exe /i ÕÒ²»µ½Ö¸¶¨µÄ¼ÓÃÜËø£¡ /t ÌáÊ¾ÐÅÏ¢£º /k 16
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4916

C:\Users\Admin\AppData\Local\Temp\YShow3D.exe

Filesize
60KB

MD5
eb64ca55fbcc7110a81c388786074860

SHA1
c85bea2ff7ef8a022e91944a2399eaec2e8839cf

SHA256
c76af622a62baf2db999467f27602ddc57c458aee19d6517be6d4021b9260ab8

SHA512
f8628a2deb7b5629c9f2536561cc7305c84800e6e2a7770201e20e0350fe24e6da2f38241f3bb74d6c14fe2763420873ae838237949ba2f239a4e83986aa4c94

Download Submit
C:\Users\Admin\AppData\Local\Temp\YShow3D.exe

Filesize
60KB

MD5
eb64ca55fbcc7110a81c388786074860

SHA1
c85bea2ff7ef8a022e91944a2399eaec2e8839cf

SHA256
c76af622a62baf2db999467f27602ddc57c458aee19d6517be6d4021b9260ab8

SHA512
f8628a2deb7b5629c9f2536561cc7305c84800e6e2a7770201e20e0350fe24e6da2f38241f3bb74d6c14fe2763420873ae838237949ba2f239a4e83986aa4c94

Download Submit
memory/444-132-0x0000000000760000-0x0000000000772000-memory.dmp

Filesize
72KB

Download