577d6b55637182c945c3d29b795a7f3f68c45144a7ffeb9b99dda6f5818c7c5b

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 11:26

Target

1ab431a1a06988119a6b192315395dd2.exe
Size

189KB
MD5

1ab431a1a06988119a6b192315395dd2
SHA1

c20511381d494ed250faea473398618c91a76a93
SHA256

577d6b55637182c945c3d29b795a7f3f68c45144a7ffeb9b99dda6f5818c7c5b
SHA512

7ae4d1d9d1ef6579d011f5c8b5b870adc417f6dde530fe5d2ae257b5ea9caca668c82256fa0bc712bf108db841c431c1fc799a5e7d3edb8551eaa13e120f9d48
SSDEEP

3072:KaU12p1ahXtxKXxUR7YqnRks77+W13XRbkmMvQdj8mW9HAokPzrc77OWw8x8cTlm:Wv9kgYWlfRpkmMv0zc769/cxm

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2828 set thread context of 1556	2828	1ab431a1a06988119a6b192315395dd2.exe	18

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	1ab431a1a06988119a6b192315395dd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	1ab431a1a06988119a6b192315395dd2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2828	1ab431a1a06988119a6b192315395dd2.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1556	2828	1ab431a1a06988119a6b192315395dd2.exe	18
PID 2828 wrote to memory of 1556	2828	1ab431a1a06988119a6b192315395dd2.exe	18
PID 2828 wrote to memory of 1556	2828	1ab431a1a06988119a6b192315395dd2.exe	18
PID 2828 wrote to memory of 1556	2828	1ab431a1a06988119a6b192315395dd2.exe	18
PID 2828 wrote to memory of 1556	2828	1ab431a1a06988119a6b192315395dd2.exe	18
PID 2828 wrote to memory of 1556	2828	1ab431a1a06988119a6b192315395dd2.exe	18
PID 2828 wrote to memory of 1556	2828	1ab431a1a06988119a6b192315395dd2.exe	18

C:\Users\Admin\AppData\Local\Temp\1ab431a1a06988119a6b192315395dd2.exe
"C:\Users\Admin\AppData\Local\Temp\1ab431a1a06988119a6b192315395dd2.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\1ab431a1a06988119a6b192315395dd2.exe
  C:\Users\Admin\AppData\Local\Temp\1ab431a1a06988119a6b192315395dd2.exe
  2⤵
  PID:1556

memory/1556-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1556-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1556-5-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1556-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1556-8-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2828-6-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download