b8a1b72ffe21ca64daf9f10e6e468f5da6782025bdbe961246ee2dbd9dd8c321

Analysis

max time kernel
177s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 18:52

Target

b8a1b72ffe21ca64daf9f10e6e468f5da6782025bdbe961246ee2dbd9dd8c321.exe
Size

710KB
MD5

3d18e785c22975d6287c6f5ee5d32af8
SHA1

4b83ecea1ecf9ea1fbd368e47637bd376aa5d771
SHA256

b8a1b72ffe21ca64daf9f10e6e468f5da6782025bdbe961246ee2dbd9dd8c321
SHA512

7c5899de7bcdb0e829eee1774dd5cfc9154bc0ece6cc53a43eacde6af97a0d6b0b92dd016dc96c2fe6f71e1b43125f4c441a3fdebe6f6b295d5c25b54c7332bf
SSDEEP

6144:QN6vsUNIPcmmmRm4EG76adSNc/B9XgGJ2FNp:4fEmREGO8oc/B9Q/p

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4240	new_kk55kk.exe_649A937EBE20B995192CA72CBFD5E23113871E61.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4240	new_kk55kk.exe_649A937EBE20B995192CA72CBFD5E23113871E61.exe
4240	new_kk55kk.exe_649A937EBE20B995192CA72CBFD5E23113871E61.exe
4240	new_kk55kk.exe_649A937EBE20B995192CA72CBFD5E23113871E61.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4240	new_kk55kk.exe_649A937EBE20B995192CA72CBFD5E23113871E61.exe
4240	new_kk55kk.exe_649A937EBE20B995192CA72CBFD5E23113871E61.exe
4240	new_kk55kk.exe_649A937EBE20B995192CA72CBFD5E23113871E61.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 4240	1176	b8a1b72ffe21ca64daf9f10e6e468f5da6782025bdbe961246ee2dbd9dd8c321.exe	81
PID 1176 wrote to memory of 4240	1176	b8a1b72ffe21ca64daf9f10e6e468f5da6782025bdbe961246ee2dbd9dd8c321.exe	81
PID 1176 wrote to memory of 4240	1176	b8a1b72ffe21ca64daf9f10e6e468f5da6782025bdbe961246ee2dbd9dd8c321.exe	81

C:\Users\Admin\AppData\Local\Temp\b8a1b72ffe21ca64daf9f10e6e468f5da6782025bdbe961246ee2dbd9dd8c321.exe
"C:\Users\Admin\AppData\Local\Temp\b8a1b72ffe21ca64daf9f10e6e468f5da6782025bdbe961246ee2dbd9dd8c321.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Local\Temp\new_kk55kk.exe_649A937EBE20B995192CA72CBFD5E23113871E61.exe
  "C:\Users\Admin\AppData\Local\Temp\new_kk55kk.exe_649A937EBE20B995192CA72CBFD5E23113871E61.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4240

C:\Users\Admin\AppData\Local\Temp\new_kk55kk.exe_649A937EBE20B995192CA72CBFD5E23113871E61.exe

Filesize
252KB

MD5
3c0dab1f2ca1829c469531a1d87b5ab7

SHA1
6cb7862198ab16381d58320f0e578e8854a522f4

SHA256
1a9b22ddb4d67a2c7289c48f476eefad6754d9bf80b8f793d6fc8954b86a1eef

SHA512
e3bbbe5ba108f1d49a6ce26f125a590055832d211199176dee0db15f66cd00ee6426dc477c72b90d55831bbd5e064bfd87526af8e72e146dad346d5a6a1d5629

Download Submit
C:\Users\Admin\AppData\Local\Temp\new_kk55kk.exe_649A937EBE20B995192CA72CBFD5E23113871E61.exe

Filesize
252KB

MD5
3c0dab1f2ca1829c469531a1d87b5ab7

SHA1
6cb7862198ab16381d58320f0e578e8854a522f4

SHA256
1a9b22ddb4d67a2c7289c48f476eefad6754d9bf80b8f793d6fc8954b86a1eef

SHA512
e3bbbe5ba108f1d49a6ce26f125a590055832d211199176dee0db15f66cd00ee6426dc477c72b90d55831bbd5e064bfd87526af8e72e146dad346d5a6a1d5629

Download Submit
memory/1176-132-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4240-136-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download