9451031f47c45d05be76aa14652500193f3c23dfa4b1b3e01f411d7c3c2d4d6c

Analysis

max time kernel
3s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 02:52

Target

011517ca0b812f5ac438d410be296445.hta
Size

11KB
MD5

011517ca0b812f5ac438d410be296445
SHA1

cfd1ce93726a7079871614604d287bb76944eac9
SHA256

9451031f47c45d05be76aa14652500193f3c23dfa4b1b3e01f411d7c3c2d4d6c
SHA512

f3bfdb8edaa165969e7664cef85618baa90c7710be5c66b704860d6b0f34296b5a4f8bd7b263ca37882cbb6e74cdc35c947d0f82073506029510e1333d239d77
SSDEEP

192:Z4O404/4mI3jRe+f4B4B4B4B4u4B4B4a4U4f4X4u4rj24u4N4qv4W4z4h4h4h4Wp:ZdpEUIIIIJIIFzmcF6qhiBvxEIIIDoIx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3060	2552	mshta.exe	28
PID 2552 wrote to memory of 3060	2552	mshta.exe	28
PID 2552 wrote to memory of 3060	2552	mshta.exe	28
PID 2552 wrote to memory of 3060	2552	mshta.exe	28
PID 2552 wrote to memory of 3060	2552	mshta.exe	28
PID 2552 wrote to memory of 3060	2552	mshta.exe	28
PID 2552 wrote to memory of 3060	2552	mshta.exe	28

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\011517ca0b812f5ac438d410be296445.hta"
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\ProgramData\qTransparent.dll,D2D1CreateFactory
  2⤵
  PID:3060