6364416dc86d03696c10d5dd2344f756a0c94452c05b47e3d5653767ae825f91

Analysis

max time kernel
156s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2023, 17:22

Target

6364416dc86d03696c10d5dd2344f756a0c94452c05b47e3d5653767ae825f91.exe
Size

780KB
MD5

2770bdb1696d986207dfabcae6fefc02
SHA1

16ed4f83bc88a24df31320a5561b00120f3a23e7
SHA256

6364416dc86d03696c10d5dd2344f756a0c94452c05b47e3d5653767ae825f91
SHA512

908f7cb8e5953854bae0eff5564c96e9e525a86b08f9c31ccee40766d2fe83e5d6b3d4b896cc525ac0f0646ad5c3e8033af3d63c0868da81210689e8b8c2f97d
SSDEEP

6144:q2MN76feTnC/XhE+XBsIDW7G1iCK5yN8hSU5YrbclErjPxCNllCfFc/fnN9A6cyp:q2MTmfXa0W7G1JrMOjPall62fosLws

Score

1^/10

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 4404	2644	6364416dc86d03696c10d5dd2344f756a0c94452c05b47e3d5653767ae825f91.exe	93
PID 2644 wrote to memory of 4404	2644	6364416dc86d03696c10d5dd2344f756a0c94452c05b47e3d5653767ae825f91.exe	93
PID 2644 wrote to memory of 4404	2644	6364416dc86d03696c10d5dd2344f756a0c94452c05b47e3d5653767ae825f91.exe	93

C:\Users\Admin\AppData\Local\Temp\6364416dc86d03696c10d5dd2344f756a0c94452c05b47e3d5653767ae825f91.exe
"C:\Users\Admin\AppData\Local\Temp\6364416dc86d03696c10d5dd2344f756a0c94452c05b47e3d5653767ae825f91.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe C:\Users\Admin\AppData\Local\Temp\ÅäÖÃÉèÖÃ.ini
  2⤵
  PID:4404