84ff67ac31015d794793e4b633c36377dee43cb698ddd443f370d55ddefb0b6b

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 11:01

Target

1931119a9442cc98150289d4bf67c9fc.hta
Size

11KB
MD5

1931119a9442cc98150289d4bf67c9fc
SHA1

09a43f6e152f52656bbfec9b172164dbe93b0feb
SHA256

84ff67ac31015d794793e4b633c36377dee43cb698ddd443f370d55ddefb0b6b
SHA512

363be8afab5abece6204291a23beb3f184b6aa4de414ac32bfbfa166f77cab94b0344b6a6f6482a8f4eff5f052dbb5ec0099011778b97b73035e6fafdab6c4d7
SSDEEP

192:Z4L4F4/4nzHTbXBi4B4B4B4B414B4B4a4HG4A4r4N41j24454N4Jv4e4z4h4h4ha:ZiQEKTEIIII0IIFZtIsAqTiUvHEIII61

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 944	4672	mshta.exe	33
PID 4672 wrote to memory of 944	4672	mshta.exe	33
PID 4672 wrote to memory of 944	4672	mshta.exe	33

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\1931119a9442cc98150289d4bf67c9fc.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\ProgramData\qMinusValues.dll,D2D1CreateFactory
  2⤵
  PID:944