c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d

Analysis

max time kernel
187s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 07:37

Target

c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe
Size

804KB
MD5

0ab1b64b8902a49edb863ee965708816
SHA1

1fe2e5926133c7a080e561a5b8dbada5b92d371a
SHA256

c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d
SHA512

a7d8e8c6a9b8ac4a31802664a911c257d224dbd7a4461e78666eb9dcfdcf33dcb66560fa377b78e92b1caafc3034948b3b36624fe16b7333ef1c6fc650e2bc67
SSDEEP

12288:Rz0iEC5/0jOBgscLu+XV2oEdp9wGRJLSwtff9rTDcrLBaekkmrAK:Rz0iECd0jIgscLRXV2oCpl9r/chikQT

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2904	c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe
2904	c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2904	c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe
2904	c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4512	2904	c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe	88
PID 2904 wrote to memory of 4512	2904	c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe	88
PID 2904 wrote to memory of 4512	2904	c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe	88
PID 2868 wrote to memory of 5056	2868	explorer.exe	91
PID 2868 wrote to memory of 5056	2868	explorer.exe	91

C:\Users\Admin\AppData\Local\Temp\c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe
"C:\Users\Admin\AppData\Local\Temp\c1bd1c714de7624bf9dec7aef03e52222fa3874811c8b308964a65fd4d7d701d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Windows\System32\SystemPropertiesAdvanced.exe
  2⤵
  PID:4512

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\System32\SystemPropertiesAdvanced.exe
  "C:\Windows\System32\SystemPropertiesAdvanced.exe"
  2⤵
  PID:5056