e05fd837a4669f40fd8cc94bb0333ce04aba57e953a010d5b4c25e4d37bc601b

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2023, 00:32

Target

e05fd837a4669f40fd8cc94bb0333ce04aba57e953a010d5b4c25e4d37bc601b.exe
Size

2.2MB
MD5

57ebe06e28582f08ad51ac6e32bd5b6b
SHA1

055b43b3032ca393584849a8679817144eca49df
SHA256

e05fd837a4669f40fd8cc94bb0333ce04aba57e953a010d5b4c25e4d37bc601b
SHA512

2481a8800d49479953792713a246c50fd1b3c99683b0ea596246176767e99492204f96d0c22fdfc8420a1ce18884e7f1cbecd3741075e506c81f47f1d42d9a51
SSDEEP

49152:xX+D4djr8RiTBPoxADY9E0T61BHRPePHvyS/eDhMwfdzC4:xX+yr8sTxoSNBHRIHvy751C4

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4708	YShow3D.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4708	YShow3D.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 4708	4048	e05fd837a4669f40fd8cc94bb0333ce04aba57e953a010d5b4c25e4d37bc601b.exe	86
PID 4048 wrote to memory of 4708	4048	e05fd837a4669f40fd8cc94bb0333ce04aba57e953a010d5b4c25e4d37bc601b.exe	86
PID 4048 wrote to memory of 4708	4048	e05fd837a4669f40fd8cc94bb0333ce04aba57e953a010d5b4c25e4d37bc601b.exe	86

C:\Users\Admin\AppData\Local\Temp\e05fd837a4669f40fd8cc94bb0333ce04aba57e953a010d5b4c25e4d37bc601b.exe
"C:\Users\Admin\AppData\Local\Temp\e05fd837a4669f40fd8cc94bb0333ce04aba57e953a010d5b4c25e4d37bc601b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Users\Admin\AppData\Local\Temp\YShow3D.exe
  C:\Users\Admin\AppData\Local\Temp\\YShow3D.exe /i [ ¼ÓÃÜËøÊÚÈ¨ÎÞÐ§¡¢Ã»ÓÐÕÒµ½Ö¸¶¨¼ÓÃÜËø ] ÊÖ»ú£º15216240651 Î¢ÐÅ£º15216240651 QQ£º3289761233 /t ÎÂÜ°ÌáÊ¾£º[ ¼ÓÃÜËøÊÚÈ¨ÎÞÐ§ ] /k 16
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4708

C:\Users\Admin\AppData\Local\Temp\YShow3D.exe

Filesize
326KB

MD5
8e96277706fe70a9f910b7f85ea8eb92

SHA1
34ea5439c8711cb386e51520f9c4b05e6997c96f

SHA256
4f3dc8c71c652cf4ef4f0bf6d09f3272afb36df142e8eba1dd645efd4b1aca14

SHA512
3605cb71116db6fa12dae3727ce01d4f68f7afb5153b7575452c0e33861ddebdb33f9c3099f86d7625fb99b4d6fd548f60290a4b3cb9ad8e66d6d5bb50bcdbfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\YShow3D.exe

Filesize
326KB

MD5
8e96277706fe70a9f910b7f85ea8eb92

SHA1
34ea5439c8711cb386e51520f9c4b05e6997c96f

SHA256
4f3dc8c71c652cf4ef4f0bf6d09f3272afb36df142e8eba1dd645efd4b1aca14

SHA512
3605cb71116db6fa12dae3727ce01d4f68f7afb5153b7575452c0e33861ddebdb33f9c3099f86d7625fb99b4d6fd548f60290a4b3cb9ad8e66d6d5bb50bcdbfa

Download Submit
memory/4048-133-0x00000000029D0000-0x0000000002AFB000-memory.dmp

Filesize
1.2MB

Download
memory/4048-138-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download