2f787581de44dc8438fec8e194714635c1125cdb9ba4f6f73a3efdcca56abb43

Analysis

max time kernel
152s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 12:57

Target

2f787581de44dc8438fec8e194714635c1125cdb9ba4f6f73a3efdcca56abb43.exe
Size

300KB
MD5

08fe06adc10513cbff1f8d4257f98200
SHA1

b74a131e98d9eaadfb3bcbb31b4c01425a38457d
SHA256

2f787581de44dc8438fec8e194714635c1125cdb9ba4f6f73a3efdcca56abb43
SHA512

2aab0630f82f0b7bd47a527a9c45af813c1208293869b47cd1c5ebe9a137e8933f9efca7bc2cdbd2a94014d1773200ab841d5ccae0d578ec388486cdb72c2042
SSDEEP

1536:wzMC6e4ikK4UKgiMqQSEq0+o20Ww2mps:TC6e4ikK4UKgiMqQSEq0+o20Ww23

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\New Folder (2).exe	2f787581de44dc8438fec8e194714635c1125cdb9ba4f6f73a3efdcca56abb43.exe
File created	\??\c:\windows\New Folder (2).exe	2f787581de44dc8438fec8e194714635c1125cdb9ba4f6f73a3efdcca56abb43.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4812	2f787581de44dc8438fec8e194714635c1125cdb9ba4f6f73a3efdcca56abb43.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4248	4812	2f787581de44dc8438fec8e194714635c1125cdb9ba4f6f73a3efdcca56abb43.exe	79
PID 4812 wrote to memory of 4248	4812	2f787581de44dc8438fec8e194714635c1125cdb9ba4f6f73a3efdcca56abb43.exe	79

C:\Users\Admin\AppData\Local\Temp\2f787581de44dc8438fec8e194714635c1125cdb9ba4f6f73a3efdcca56abb43.exe
"C:\Users\Admin\AppData\Local\Temp\2f787581de44dc8438fec8e194714635c1125cdb9ba4f6f73a3efdcca56abb43.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812
- \??\c:\windows\explorer.exe
  c:\windows\explorer.exe
  2⤵
  - Modifies registry class
  PID:4248

memory/4812-132-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/4812-136-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download