c7798f7edb5a28982dd056eb69da25530332ccdbf5650acc654bd718a1f4a58e

Analysis

max time kernel
137s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 13:28

Target

c7798f7edb5a28982dd056eb69da25530332ccdbf5650acc654bd718a1f4a58e.chm
Size

20KB
MD5

b97ea7b30d5c0eeafc5c1e4d17695e7f
SHA1

7e129ff61e107252ca616b9dd39d4f24500e3a97
SHA256

c7798f7edb5a28982dd056eb69da25530332ccdbf5650acc654bd718a1f4a58e
SHA512

e047424dd10de2f30343745d45fb2c313b122774598f5f8e895e2512a7fa239119ee262bcb01b16dc1b65fe1fd45f27468432eba28c6e4ad7ec1dbde4ea9fcbd
SSDEEP

384:TLVF2tLpYUY2YjnWO8+IOWmvNZa0PEnY5:T36L+xDjnHIevNTh5

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 4668	1972	hh.exe	78
PID 1972 wrote to memory of 4668	1972	hh.exe	78
PID 4668 wrote to memory of 3828	4668	cmd.exe	80
PID 4668 wrote to memory of 3828	4668	cmd.exe	80

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3524