Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
15-11-2023 11:20
General
-
Target
PhotoScape.exe
-
Size
6.5MB
-
MD5
41f0e8918566202dc7b8a6b5cd481efd
-
SHA1
0de7d1c440c8b56afdb2b8a02bb4886b97175d7b
-
SHA256
58a8bd67ff3e1c7b16088d380c751e3d35f3ec8f819632a7861a334a757573f0
-
SHA512
574a317bf8e009822c86d83a3ab57f79726259ce91bcbf82a99dca144b59c108be59bcf4d35e6d41a74151f418d2afdb678426137939bef9901f48919fee8e31
-
SSDEEP
49152:idoYaqenjcuti7F6qAdNb52dmfLvvoCTuqDCUraokMh6UvrZHLsno75NzTCwk/M6:Cb865AdumfD2Khcwkvw2eYFGC
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PhotoScape.exe"C:\Users\Admin\AppData\Local\Temp\PhotoScape.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵