9e4e80e78fae81f4b60538b9269927d2a77babb53696bd217e718dea70f83067

Analysis

max time kernel
61s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 02:45

Target

9e4e80e78fae81f4b60538b9269927d2a77babb53696bd217e718dea70f83067.exe
Size

4.5MB
MD5

838e9826ff624cbcbcc6832fba2d262c
SHA1

e72b6564fc26afb9134ba4b3a6c12ff23c086ec4
SHA256

9e4e80e78fae81f4b60538b9269927d2a77babb53696bd217e718dea70f83067
SHA512

e57d1554e9961cf38f77ab6857c87f7af06f2a674329657a64b55cb52a3eb900d9265bdb18353e06742865a1bb910e3555b01ba8cf242bcabb6c2efe742889c9
SSDEEP

98304:CSqpCfxCxsGFYXWpu423cIkuYhrWNSETPO0De2Xq1AsNu8p0Xw+/cMHm:CrpC5aFCWpycx7iAkGka1Aa5p0h/d

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3784	YShow3D.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3784	YShow3D.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 3784	4992	9e4e80e78fae81f4b60538b9269927d2a77babb53696bd217e718dea70f83067.exe	81
PID 4992 wrote to memory of 3784	4992	9e4e80e78fae81f4b60538b9269927d2a77babb53696bd217e718dea70f83067.exe	81
PID 4992 wrote to memory of 3784	4992	9e4e80e78fae81f4b60538b9269927d2a77babb53696bd217e718dea70f83067.exe	81

C:\Users\Admin\AppData\Local\Temp\9e4e80e78fae81f4b60538b9269927d2a77babb53696bd217e718dea70f83067.exe
"C:\Users\Admin\AppData\Local\Temp\9e4e80e78fae81f4b60538b9269927d2a77babb53696bd217e718dea70f83067.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Local\Temp\YShow3D.exe
  C:\Users\Admin\AppData\Local\Temp\\YShow3D.exe /i Çë²åÈëÈí¼þ¹· /t ÌáÊ¾£ºB8 /k 64
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3784

C:\Users\Admin\AppData\Local\Temp\YShow3D.exe

Filesize
326KB

MD5
08c643c256d31bf018d9b099482ea1a7

SHA1
8235a6d3e6ceaf7f4237c2b81a871fa936d64984

SHA256
3eb030744468aad8e778b22d62c6610f84f6c6371219e1469afed4e3f1427781

SHA512
a46e5d258e145b26006dd175a41dfa9e39db92fe604683c180a1089047d9d8ef229f1761e07b66a22382f4fdf8c5e0e1e081b867228c0a63eb9f7627329d2085

Download Submit
C:\Users\Admin\AppData\Local\Temp\YShow3D.exe

Filesize
326KB

MD5
08c643c256d31bf018d9b099482ea1a7

SHA1
8235a6d3e6ceaf7f4237c2b81a871fa936d64984

SHA256
3eb030744468aad8e778b22d62c6610f84f6c6371219e1469afed4e3f1427781

SHA512
a46e5d258e145b26006dd175a41dfa9e39db92fe604683c180a1089047d9d8ef229f1761e07b66a22382f4fdf8c5e0e1e081b867228c0a63eb9f7627329d2085

Download Submit
memory/4992-132-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/4992-133-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/4992-134-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/4992-138-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/4992-139-0x0000000002890000-0x00000000029BB000-memory.dmp

Filesize
1.2MB

Download