d4bf295896b49afa32be6ec862ad12837f948fab9db5a8d30779c479a4801039

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-06-2023 18:25

Target

d4bf295896b49afa32be6ec862ad12837f948fab9db5a8d30779c479a4801039.exe
Size

1.5MB
MD5

ca796b2a95727c944062c847813a878f
SHA1

3d6cbacf886a0dfd1c533356d0e1256e4cd552f2
SHA256

d4bf295896b49afa32be6ec862ad12837f948fab9db5a8d30779c479a4801039
SHA512

cefb5e6ec05d2dc1bfe4e1e9bcc13029ff226c27f9280f66bd47a7c8c14040b6c69d292705c5ed19eef190a32b1b6f953123a12bfff929705dd50ed4bd891043
SSDEEP

49152:JdWASQXKvQ0nWiQxqu6Tjuo4ZGTA8Lp1v81Ry3H/:nWTQWQULuoHLSRy3/

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

YShow3D.exe

pid process

1088 YShow3D.exe
Loads dropped DLL 1 IoCs

Processes:

d4bf295896b49afa32be6ec862ad12837f948fab9db5a8d30779c479a4801039.exe

pid process

1684 d4bf295896b49afa32be6ec862ad12837f948fab9db5a8d30779c479a4801039.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

YShow3D.exe

pid process

1088 YShow3D.exe

pid	process
1088	YShow3D.exe

pid	process
1684	d4bf295896b49afa32be6ec862ad12837f948fab9db5a8d30779c479a4801039.exe

pid	process
1088	YShow3D.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d4bf295896b49afa32be6ec862ad12837f948fab9db5a8d30779c479a4801039.exe

description	pid	process	target process
PID 1684 wrote to memory of 1088	1684	d4bf295896b49afa32be6ec862ad12837f948fab9db5a8d30779c479a4801039.exe	YShow3D.exe
PID 1684 wrote to memory of 1088	1684	d4bf295896b49afa32be6ec862ad12837f948fab9db5a8d30779c479a4801039.exe	YShow3D.exe
PID 1684 wrote to memory of 1088	1684	d4bf295896b49afa32be6ec862ad12837f948fab9db5a8d30779c479a4801039.exe	YShow3D.exe
PID 1684 wrote to memory of 1088	1684	d4bf295896b49afa32be6ec862ad12837f948fab9db5a8d30779c479a4801039.exe	YShow3D.exe

C:\Users\Admin\AppData\Local\Temp\YShow3D.exe
Filesize
326KB

MD5
8e96277706fe70a9f910b7f85ea8eb92

SHA1
34ea5439c8711cb386e51520f9c4b05e6997c96f

SHA256
4f3dc8c71c652cf4ef4f0bf6d09f3272afb36df142e8eba1dd645efd4b1aca14

SHA512
3605cb71116db6fa12dae3727ce01d4f68f7afb5153b7575452c0e33861ddebdb33f9c3099f86d7625fb99b4d6fd548f60290a4b3cb9ad8e66d6d5bb50bcdbfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\YShow3D.exe
Filesize
326KB

MD5
8e96277706fe70a9f910b7f85ea8eb92

SHA1
34ea5439c8711cb386e51520f9c4b05e6997c96f

SHA256
4f3dc8c71c652cf4ef4f0bf6d09f3272afb36df142e8eba1dd645efd4b1aca14

SHA512
3605cb71116db6fa12dae3727ce01d4f68f7afb5153b7575452c0e33861ddebdb33f9c3099f86d7625fb99b4d6fd548f60290a4b3cb9ad8e66d6d5bb50bcdbfa

Download Submit
\Users\Admin\AppData\Local\Temp\YShow3D.exe
Filesize
326KB

MD5
8e96277706fe70a9f910b7f85ea8eb92

SHA1
34ea5439c8711cb386e51520f9c4b05e6997c96f

SHA256
4f3dc8c71c652cf4ef4f0bf6d09f3272afb36df142e8eba1dd645efd4b1aca14

SHA512
3605cb71116db6fa12dae3727ce01d4f68f7afb5153b7575452c0e33861ddebdb33f9c3099f86d7625fb99b4d6fd548f60290a4b3cb9ad8e66d6d5bb50bcdbfa

Download Submit
memory/1684-55-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/1684-54-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/1684-62-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/1684-63-0x0000000002440000-0x000000000256B000-memory.dmp

Filesize
1.2MB

Download