138e2e4934e651b0e2e2b227d034de67e57d906109bfb7f0798e83c49763ebfe

Analysis

max time kernel
164s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2023, 15:45

Target

120-[ModBot]-VNCBRUTE-MSSQL-2007/120-[ModBot]-VNCBRUTE-MSSQL-2007/encrypt.exe
Size

52KB
MD5

e20f3260419d966d4393fac3ab17654c
SHA1

f27320a6395db1cffb1e51c38a7ddf0926a3dab3
SHA256

22b915a45bc009e6f2438b0451dc2ae22fe2309a7b5893281624a6044d56ee00
SHA512

2bae3b63759c2245d402a0a78dc50e1d2c3029ac5e30832a83757ed5a1af4ed55bde85c547258f80b688ba88754ec5e87f84b67f5bbc501aa9162a72878e66b8
SSDEEP

768:YG1A+6jAfJWRTZMouj8Poq2DqqqqwkLD3UxmEKX:j1AncfJ8Poq2DqqqqymEw

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
488	encrypt.exe
488	encrypt.exe

C:\Users\Admin\AppData\Local\Temp\120-[ModBot]-VNCBRUTE-MSSQL-2007\120-[ModBot]-VNCBRUTE-MSSQL-2007\encrypt.exe
"C:\Users\Admin\AppData\Local\Temp\120-[ModBot]-VNCBRUTE-MSSQL-2007\120-[ModBot]-VNCBRUTE-MSSQL-2007\encrypt.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:488

memory/488-133-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/488-134-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download