3e81ef121a075d36e7eafe9a9428937afeb2367f7f67848227c462808c22b00e

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 02:03

Target

4b4f5318b73ac9d8419c09433690dc26.exe
Size

163KB
MD5

4b4f5318b73ac9d8419c09433690dc26
SHA1

4991825ed4c058cda0feeeb9f85f55489133955e
SHA256

3e81ef121a075d36e7eafe9a9428937afeb2367f7f67848227c462808c22b00e
SHA512

56a1b8839d8cb00feb4e42b40e394fa362b0a0a44b37e2a9f311094823669e742a52a7ed391cc459defe986737b7e6af5d95a6b6425f0310a4756d25f6fed50d
SSDEEP

3072:ytLjUKeH0/YhkeIDTEUBKQmngsiNHUlkVSofggYnYdtdeL67vBzTPM:ytkKexuTcURlZfYYdneL6pg

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2000	4b4f5318b73ac9d8419c09433690dc26.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2144	2000	4b4f5318b73ac9d8419c09433690dc26.exe	28
PID 2000 wrote to memory of 2144	2000	4b4f5318b73ac9d8419c09433690dc26.exe	28
PID 2000 wrote to memory of 2144	2000	4b4f5318b73ac9d8419c09433690dc26.exe	28
PID 2000 wrote to memory of 2144	2000	4b4f5318b73ac9d8419c09433690dc26.exe	28

C:\Users\Admin\AppData\Local\Temp\4b4f5318b73ac9d8419c09433690dc26.exe
"C:\Users\Admin\AppData\Local\Temp\4b4f5318b73ac9d8419c09433690dc26.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\5CBA03AF7BF242D366F222AC.exe
  2⤵
  PID:2144

memory/2000-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2000-1-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2000-4-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download