e8582220f161aef10bcba30369f4d9a3f2a53024b9cd4a5f9f9fecfb98ba8be2

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:47

Target

WindowBlinds/WBCONFIG.exe
Size

1.0MB
MD5

d80da4ab2b60bf04b26687a170fe964e
SHA1

3e1104a2f189d21ea51d94dc466caa1f662cd8a2
SHA256

38bde7ad0d8e36874266934dd2eba531cd20d5d27a581c6415e8ed117df17453
SHA512

74086b038ef77b52d0cc5dba982b966c3cf6cc86d7b6e139b587e91a743feb7462e6b771c91a32cb653392482914ff1245679e1b912e74657e47b8ac0b6a20a5
SSDEEP

12288:V454yRQ7C0M/OmfmomoZtlOw60dM7PJ8KQGZGve1LJGhzIHsozCdadZYr:C9KCHYomoZQ0SjJVxZGWNsozCYdi

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2536	2656	WBCONFIG.exe	28
PID 2656 wrote to memory of 2536	2656	WBCONFIG.exe	28
PID 2656 wrote to memory of 2536	2656	WBCONFIG.exe	28
PID 2656 wrote to memory of 2536	2656	WBCONFIG.exe	28

C:\Users\Admin\AppData\Local\Temp\WindowBlinds\WBCONFIG.exe
"C:\Users\Admin\AppData\Local\Temp\WindowBlinds\WBCONFIG.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\System32\pcaui.exe
  "C:\Windows\System32\pcaui.exe" /g {11111111-1111-1111-1111-111111111111} /x {bc6ceace-d00f-4fff-b673-16d53fa18088} /a "WindowBlinds 6 (and earlier)" /v "Stardock Corporation" /s "WindowBlinds 6 (and earlier) is incompatible with this version of Windows. For more information, contact Stardock Corporation." /b 2 /e "C:\Users\Admin\AppData\Local\Temp\WindowBlinds\WBCONFIG.exe"
  2⤵
  PID:2536