e8ad13f1f12027670ed2a01249e45ee65b38accbddd3ec2473c8d919c5bea5ba

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 00:55

Target

1e8ba02d6dbbede5b548b8dd300e63fd.exe
Size

570KB
MD5

1e8ba02d6dbbede5b548b8dd300e63fd
SHA1

c5fc1c269422d266b202bec97593ff24cb90986c
SHA256

e8ad13f1f12027670ed2a01249e45ee65b38accbddd3ec2473c8d919c5bea5ba
SHA512

b4db434f23797825d57710ed70206938e56aab32bc76667fdcef350c492ab291ebd5e9a52bad1eedc9da5eda2155ff47e70c991182830648378a849c71975867
SSDEEP

12288:6wwIXw0bdyx98oWOU1ZIH5JsXXFJ6upKIgpWy/XZT9KFun3aHv:bW2oWOQZIyFJjUINFHv

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
924	stdrt.exe

Loads dropped DLL 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
924	stdrt.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
924	stdrt.exe
3104	OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 924	2232	1e8ba02d6dbbede5b548b8dd300e63fd.exe	16
PID 2232 wrote to memory of 924	2232	1e8ba02d6dbbede5b548b8dd300e63fd.exe	16
PID 2232 wrote to memory of 924	2232	1e8ba02d6dbbede5b548b8dd300e63fd.exe	16

C:\Users\Admin\AppData\Local\Temp\1e8ba02d6dbbede5b548b8dd300e63fd.exe
"C:\Users\Admin\AppData\Local\Temp\1e8ba02d6dbbede5b548b8dd300e63fd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\mrt446B.tmp\stdrt.exe
  "C:\Users\Admin\AppData\Local\Temp\mrt446B.tmp\stdrt.exe" /SF "C:\Users\Admin\AppData\Local\Temp\1e8ba02d6dbbede5b548b8dd300e63fd.exe" /SO94208
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3104