c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 07:37

Target

c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe
Size

804KB
MD5

0ab1b64b8902a49edb863ee965708816
SHA1

1fe2e5926133c7a080e561a5b8dbada5b92d371a
SHA256

c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d
SHA512

a7d8e8c6a9b8ac4a31802664a911c257d224dbd7a4461e78666eb9dcfdcf33dcb66560fa377b78e92b1caafc3034948b3b36624fe16b7333ef1c6fc650e2bc67
SSDEEP

12288:Rz0iEC5/0jOBgscLu+XV2oEdp9wGRJLSwtff9rTDcrLBaekkmrAK:Rz0iECd0jIgscLRXV2oCpl9r/chikQT

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2792	c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2792	c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe
2792	c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2684	2792	c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe	29
PID 2792 wrote to memory of 2684	2792	c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe	29
PID 2792 wrote to memory of 2684	2792	c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe	29
PID 2792 wrote to memory of 2684	2792	c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe	29
PID 2140 wrote to memory of 2780	2140	explorer.exe	31
PID 2140 wrote to memory of 2780	2140	explorer.exe	31
PID 2140 wrote to memory of 2780	2140	explorer.exe	31

C:\Users\Admin\AppData\Local\Temp\c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe
"C:\Users\Admin\AppData\Local\Temp\c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Windows\System32\SystemPropertiesAdvanced.exe
  2⤵
  PID:2684

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\System32\SystemPropertiesAdvanced.exe
  "C:\Windows\System32\SystemPropertiesAdvanced.exe"
  2⤵
  PID:2780