fc115aa3b212d6d695b7a5c96536f7e72d433928c86193a8d5be85f4b08fe2a5

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 08:49

Target

611a7fa897f0b9484169c1d9e2b81de0.exe
Size

1.2MB
MD5

611a7fa897f0b9484169c1d9e2b81de0
SHA1

7f26fdc1ed6dc32992907a14503934c06762e274
SHA256

fc115aa3b212d6d695b7a5c96536f7e72d433928c86193a8d5be85f4b08fe2a5
SHA512

e4fccfe2f65b392091b35c8fba688e9d851b79b25d2912abe92ea2ec2c11b7595d533b3493b967d596e0d1d720db0c6ada71a71814b8ad4761046bb8acdb52c9
SSDEEP

24576:4zmMHxPxfyoJkOq+Uqh0Pg1xtojQyA/G0/k1eUl0+Hr8D/qTJeQMZsOPYnLnZU:4XHNxjkOeExtGuz2l0EsqTkQMZD8ZU

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ole32.dll	611a7fa897f0b9484169c1d9e2b81de0.exe
File created	C:\Windows\SysWOW64\ole32.dll	611a7fa897f0b9484169c1d9e2b81de0.exe
File opened for modification	C:\Windows\SysWOW64\advapi32.dll	611a7fa897f0b9484169c1d9e2b81de0.exe
File created	C:\Windows\SysWOW64\advapi32.dll	611a7fa897f0b9484169c1d9e2b81de0.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4072 set thread context of 4848	4072	611a7fa897f0b9484169c1d9e2b81de0.exe	89

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4072	611a7fa897f0b9484169c1d9e2b81de0.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4848	4072	611a7fa897f0b9484169c1d9e2b81de0.exe	89
PID 4072 wrote to memory of 4848	4072	611a7fa897f0b9484169c1d9e2b81de0.exe	89
PID 4072 wrote to memory of 4848	4072	611a7fa897f0b9484169c1d9e2b81de0.exe	89
PID 4072 wrote to memory of 4848	4072	611a7fa897f0b9484169c1d9e2b81de0.exe	89
PID 4072 wrote to memory of 4848	4072	611a7fa897f0b9484169c1d9e2b81de0.exe	89
PID 4072 wrote to memory of 4848	4072	611a7fa897f0b9484169c1d9e2b81de0.exe	89
PID 4072 wrote to memory of 4848	4072	611a7fa897f0b9484169c1d9e2b81de0.exe	89

C:\Users\Admin\AppData\Local\Temp\611a7fa897f0b9484169c1d9e2b81de0.exe
"C:\Users\Admin\AppData\Local\Temp\611a7fa897f0b9484169c1d9e2b81de0.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\Temp\611a7fa897f0b9484169c1d9e2b81de0.exe
  C:\Users\Admin\AppData\Local\Temp\611a7fa897f0b9484169c1d9e2b81de0.exe
  2⤵
  PID:4848

memory/4072-0-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/4072-1-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/4072-2-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/4072-3-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/4072-10-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/4848-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4848-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4848-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4848-8-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4848-12-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/4848-14-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4848-13-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download