3aaeb783696e53516e882bbdc909689b80cc38f5db65ce5bdb7ade7a709f6c92

Analysis

max time kernel
125s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 22:14

Target

1e22d593554cec2ce2f41ec55844ce3b.exe
Size

2.1MB
MD5

1e22d593554cec2ce2f41ec55844ce3b
SHA1

3c48b7b53676f099f80cb93751e0c37227daf587
SHA256

3aaeb783696e53516e882bbdc909689b80cc38f5db65ce5bdb7ade7a709f6c92
SHA512

5c7e803317febd6288901ecb94b5f1cfdfad36f29fb0f25ac7916b1b816e27f255d27a772b490338e07cfa1c8d6f7831b9b31b5e35bc9447c65149dbd944bf64
SSDEEP

49152:kv8HiB7rS+952exDtxYksciQvJbJr3DqaqhklLY99/ERVvA/eUPAeIx7:BiBvSC2SxYksAr3DqaXlLY99/AweUYb

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4800	AutoHotkey.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4800	AutoHotkey.exe
4800	AutoHotkey.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4800	AutoHotkey.exe
4800	AutoHotkey.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4800	4248	1e22d593554cec2ce2f41ec55844ce3b.exe	22
PID 4248 wrote to memory of 4800	4248	1e22d593554cec2ce2f41ec55844ce3b.exe	22

C:\Users\Admin\AppData\Local\Temp\1e22d593554cec2ce2f41ec55844ce3b.exe
"C:\Users\Admin\AppData\Local\Temp\1e22d593554cec2ce2f41ec55844ce3b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe
  "C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe" /f "\\.\pipe\AHKJPJFIFJK"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4800

memory/4248-6-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

Filesize
64KB

Download
memory/4248-5-0x0000000000CD0000-0x0000000000DD0000-memory.dmp

Filesize
1024KB

Download