1ab1fc63ec206bfc196177f4e1f4ec0fad539f1f836b08aa3d6b2239a09c35c6

Analysis

max time kernel
141s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2023, 22:57

Target

amidst-v4-7.exe
Size

1.8MB
MD5

4eb66ad2469f6d3dfa2dafd6d3369308
SHA1

2a4f6a875381a5b85b5a354ee8c5731b904725f3
SHA256

1ab1fc63ec206bfc196177f4e1f4ec0fad539f1f836b08aa3d6b2239a09c35c6
SHA512

c1895d3f4fd62b1b8e8c998c98af607bac3c412844e6f1952b64ac572df54cb8e3d344b9ac3c297c5da6a06d2dfa024307412f391637817fbdf56665a9d11fa5
SSDEEP

24576:6FLBgeMvwAKe3vb8azyf9f1vYoVjYr0QkOD6AgOa6lQEXu353fwgfyIl9/I0YFLS:OBghKiAyYAoBYFkOD6/OhaVvfqd7LBg

Score

1^/10

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 4940	396	amidst-v4-7.exe	80
PID 396 wrote to memory of 4940	396	amidst-v4-7.exe	80

C:\Users\Admin\AppData\Local\Temp\amidst-v4-7.exe
"C:\Users\Admin\AppData\Local\Temp\amidst-v4-7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:396
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Xms512m -Xmx2048m -classpath "C:\Users\Admin\AppData\Local\Temp\amidst-v4-7.exe" amidst.Amidst
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4940

memory/396-141-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4940-144-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/4940-209-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/4940-231-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/4940-236-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download