bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2023 20:29

Target

bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe
Size

1.9MB
MD5

fad4ac9878368dd2407c72e6f3c03fd4
SHA1

f342f78f5349b040c9ce01c0378fc23ebfe7ec30
SHA256

bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99
SHA512

caaf74abe6fef3506798d5642d3546e075f75b9aa8ea6885fce2907c1ba1a9d1755acad46e615cb59d670a98057eb69717f5d5ef2210fed2447c67e6381ddb94
SSDEEP

24576:ILagiQ5pjdQoJXBfBCq+hAERZbfbrRS7lQ3Uq8QDUwZjDZeWYRJZO0kGCn/CQm:ILni0QsBP++StfPQ7kU7QrD0XZOxPs

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

YShow3D.exe

pid process

1948 YShow3D.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

YShow3D.exe

pid process

1948 YShow3D.exe

pid	process
1948	YShow3D.exe

pid	process
1948	YShow3D.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe

description	pid	process	target process
PID 2096 wrote to memory of 1948	2096	bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe	YShow3D.exe
PID 2096 wrote to memory of 1948	2096	bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe	YShow3D.exe
PID 2096 wrote to memory of 1948	2096	bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe	YShow3D.exe

C:\Users\Admin\AppData\Local\Temp\bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe
"C:\Users\Admin\AppData\Local\Temp\bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096

C:\Users\Admin\AppData\Local\Temp\YShow3D.exe
Filesize
326KB

MD5
08c643c256d31bf018d9b099482ea1a7

SHA1
8235a6d3e6ceaf7f4237c2b81a871fa936d64984

SHA256
3eb030744468aad8e778b22d62c6610f84f6c6371219e1469afed4e3f1427781

SHA512
a46e5d258e145b26006dd175a41dfa9e39db92fe604683c180a1089047d9d8ef229f1761e07b66a22382f4fdf8c5e0e1e081b867228c0a63eb9f7627329d2085

Download Submit
C:\Users\Admin\AppData\Local\Temp\YShow3D.exe
Filesize
326KB

MD5
08c643c256d31bf018d9b099482ea1a7

SHA1
8235a6d3e6ceaf7f4237c2b81a871fa936d64984

SHA256
3eb030744468aad8e778b22d62c6610f84f6c6371219e1469afed4e3f1427781

SHA512
a46e5d258e145b26006dd175a41dfa9e39db92fe604683c180a1089047d9d8ef229f1761e07b66a22382f4fdf8c5e0e1e081b867228c0a63eb9f7627329d2085

Download Submit
memory/2096-134-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2096-133-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2096-139-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2096-140-0x0000000002940000-0x0000000002A6B000-memory.dmp

Filesize
1.2MB

Download