f155531903702b156862b4f4f5f188764ff5180fb43ca40df1d87a028ebe24f2

Analysis

max time kernel
143s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 14:30

Target

25bcaa77158edf2a2b52d0088b7cb137.hta
Size

11KB
MD5

25bcaa77158edf2a2b52d0088b7cb137
SHA1

ff06fd9a8725f42e01444a0fc683d46de4a264c8
SHA256

f155531903702b156862b4f4f5f188764ff5180fb43ca40df1d87a028ebe24f2
SHA512

c2eaa5e1a71233c5f61677708c22b377796490e767cee798de78455b439742382b5570193670f07a0876102bce90704c8b70900da33315b2b54e3850026cbd7f
SSDEEP

192:Z4tq41K4/4ClbJpEdtT4B4B4B4B4j4B4B4a40424M4X4Zj24Y4N45v464z4h4h4h:ZGqUKEmIIIIYIIFdBHoIqxiKvFEIIIl9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 2448	4528	mshta.exe	26
PID 4528 wrote to memory of 2448	4528	mshta.exe	26
PID 4528 wrote to memory of 2448	4528	mshta.exe	26

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\25bcaa77158edf2a2b52d0088b7cb137.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\ProgramData\qEscKey.dll,D2D1CreateFactory
  2⤵
  PID:2448