54d831932afe4b4f70ae4ce67aff9937efecf183e6ed77ae42e7523f76f6c7df

Analysis

max time kernel
137s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
26-08-2023 08:15

Target

54d831932afe4b4f70ae4ce67aff9937efecf183e6ed77ae42e7523f76f6c7df.exe
Size

4.5MB
MD5

27338b70dda2ee0f7fba109c3d7dc3b5
SHA1

2251889c98989df9f7d16541756de8654f97a26b
SHA256

54d831932afe4b4f70ae4ce67aff9937efecf183e6ed77ae42e7523f76f6c7df
SHA512

65988669ba2c70b2160964ae9af584c87f474b107cd1ea8572f61bf4e35b4c146e16be5efd9229e6a71d69be35bd6b97f18ffa5ae892e5e105270d8ea8211640
SSDEEP

98304:gLip5x5osQD/5NONsr1/l3WHYP+XpWHmxybt2Hldk9E999vaOpZbS:JppW5UYeWuyWdk9E9yOpZbS

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{026B30D4-77CE-477B-BD12-72925DE5F950}.catalogItem	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
216	54d831932afe4b4f70ae4ce67aff9937efecf183e6ed77ae42e7523f76f6c7df.exe
216	54d831932afe4b4f70ae4ce67aff9937efecf183e6ed77ae42e7523f76f6c7df.exe

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:2172

C:\Users\Admin\AppData\Local\Temp\54d831932afe4b4f70ae4ce67aff9937efecf183e6ed77ae42e7523f76f6c7df.exe
"C:\Users\Admin\AppData\Local\Temp\54d831932afe4b4f70ae4ce67aff9937efecf183e6ed77ae42e7523f76f6c7df.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:216