50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4

Analysis

max time kernel
111s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2022, 18:45

Target

50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe
Size

16KB
MD5

afb7e2fc9f2d3d7f456f5b36ad62ffd0
SHA1

a0fad432648d672286e900af79a5c0bd1c555cf1
SHA256

50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4
SHA512

6dac722c57fe9deb163f542369e0e9ca57c0d838bb95bfbb2dfddd038f12cbcf0e0ecbbaa179cb209fb2d5f72848a21c8032404711383ef75d6c76ff15fe4c10
SSDEEP

48:7rD0dSH9To84B0pOvwbFVlyGKlT6bO0vhn4VkuJCWUbrpp8/F/VXwAEhK2:HD0cHy84BWOobFVkG66OtUbrpePEo2

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2072	50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2748	2072	50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe	81
PID 2072 wrote to memory of 2748	2072	50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe	81
PID 2072 wrote to memory of 2748	2072	50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe	81
PID 2072 wrote to memory of 4496	2072	50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe	82
PID 2072 wrote to memory of 4496	2072	50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe	82
PID 2072 wrote to memory of 4496	2072	50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe	82
PID 2072 wrote to memory of 604	2072	50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe	83
PID 2072 wrote to memory of 604	2072	50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe	83
PID 2072 wrote to memory of 604	2072	50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe	83
PID 2072 wrote to memory of 4812	2072	50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe	84
PID 2072 wrote to memory of 4812	2072	50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe	84
PID 2072 wrote to memory of 4812	2072	50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe	84

C:\Users\Admin\AppData\Local\Temp\50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe
"C:\Users\Admin\AppData\Local\Temp\50fd4034f9619e861a77565991b89c3e01b90fa6f450661856fe4d0bf84f2df4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32 /s C:\Windows\system32\DTools.dll
  2⤵
  PID:2748
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32 /s C:\Windows\system32\CyControlFuntions.dll
  2⤵
  PID:4496
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32 /s C:\Windows\system32\HDSXGpsDOReport.dll
  2⤵
  PID:604
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32 /s C:\Windows\system32\MsHDUserManagerPort.dll
  2⤵
  PID:4812

memory/2072-138-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download