c4fdc8f48af5c41858c80f931839b7de65dc787e79802906be5ea14c5731bda8

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2023, 01:06

Target

c4fdc8f48af5c41858c80f931839b7de65dc787e79802906be5ea14c5731bda8.exe
Size

804KB
MD5

7f6de68412bcd533071d2e4aa9bbf5a8
SHA1

f596dc973f2cd38e4b1d7a7c18ec023aa5de6bee
SHA256

c4fdc8f48af5c41858c80f931839b7de65dc787e79802906be5ea14c5731bda8
SHA512

070554513dc401bde583065c1e0c18927bdf1a1a9751decb41af5f810d4bd3efddf6785118f0a8cee7ba9305db104a460390e4ff344affbe56647d1b38034693
SSDEEP

12288:Rz0img5/0jOBgscLu+XV2oEdp9wGRJLSwtff1J4AjrLeaeFkmrAK:Rz0imgd0jIgscLRXV2oCpl1JXj+jkQT

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3716	c4fdc8f48af5c41858c80f931839b7de65dc787e79802906be5ea14c5731bda8.exe
3716	c4fdc8f48af5c41858c80f931839b7de65dc787e79802906be5ea14c5731bda8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3716	c4fdc8f48af5c41858c80f931839b7de65dc787e79802906be5ea14c5731bda8.exe
3716	c4fdc8f48af5c41858c80f931839b7de65dc787e79802906be5ea14c5731bda8.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 2064	3716	c4fdc8f48af5c41858c80f931839b7de65dc787e79802906be5ea14c5731bda8.exe	85
PID 3716 wrote to memory of 2064	3716	c4fdc8f48af5c41858c80f931839b7de65dc787e79802906be5ea14c5731bda8.exe	85
PID 3716 wrote to memory of 2064	3716	c4fdc8f48af5c41858c80f931839b7de65dc787e79802906be5ea14c5731bda8.exe	85
PID 3752 wrote to memory of 4124	3752	explorer.exe	88
PID 3752 wrote to memory of 4124	3752	explorer.exe	88

C:\Users\Admin\AppData\Local\Temp\c4fdc8f48af5c41858c80f931839b7de65dc787e79802906be5ea14c5731bda8.exe
"C:\Users\Admin\AppData\Local\Temp\c4fdc8f48af5c41858c80f931839b7de65dc787e79802906be5ea14c5731bda8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Windows\System32\SystemPropertiesAdvanced.exe
  2⤵
  PID:2064

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\System32\SystemPropertiesAdvanced.exe
  "C:\Windows\System32\SystemPropertiesAdvanced.exe"
  2⤵
  PID:4124