7aa0f33cae812fa6d364adf593d24e672f8179f5e941cb49df0d6701335c7447

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 17:01

Target

KingRoot PC v1.1/KingRoot.exe
Size

3.6MB
MD5

00a8eb3f0e1690db7b8db7a422a0ed3e
SHA1

9bb37771829c9d606ec8750b2b3b6094cc45fa6f
SHA256

52f242a655e1b0a41786b0ba256f9baef317b56ff7c724afe985e1252eeb68b1
SHA512

6b090fd1fa9ca564546951e5b7e00477b416d084ed552fee11aa88de544104c380215e9110df778cec279b3cbdbb499929b318618427faad4e2fe5c73cf8d7e3
SSDEEP

24576:q8ZFRW/lZtqQ7e9Fa83eGwB4tman+pomFoDoFxcYfwA:q8ZzuH38FwGMuman+pQoJI

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2716	KingRoot.exe
2716	KingRoot.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 1132	2716	KingRoot.exe	92
PID 2716 wrote to memory of 1132	2716	KingRoot.exe	92
PID 2716 wrote to memory of 1132	2716	KingRoot.exe	92
PID 1132 wrote to memory of 3684	1132	adb.exe	95
PID 1132 wrote to memory of 3684	1132	adb.exe	95
PID 1132 wrote to memory of 3684	1132	adb.exe	95

memory/1132-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3684-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3684-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3684-3-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3684-4-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download