Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 02:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2484ae3c3b81170f75e6ee512c04e14a.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2484ae3c3b81170f75e6ee512c04e14a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
2484ae3c3b81170f75e6ee512c04e14a.exe
-
Size
156KB
-
MD5
2484ae3c3b81170f75e6ee512c04e14a
-
SHA1
cf49513796222e75e7f8ce53f30939059762324e
-
SHA256
ba0bbaddf18f94738a211534ebdeb4b9b9722996f2570e09fbd0a9eac85f14fa
-
SHA512
63b431e63650fa6f48d459ab55648e7f92cf9fcf78e9a6f22adacf82e6718a2a7b8faec927eb12a911d8cbf4f042d29a0ebcca1685a322741bece7365f2c7fcb
-
SSDEEP
3072:XASDiVGZgXVnV7yKbSMVhUUeBN9UYH+IPbhqFrefpFMUoh:iGWXDyKbSQ5IRPsFYMhh
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2632 set thread context of 4868 2632 2484ae3c3b81170f75e6ee512c04e14a.exe 91 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\PCGWIN32.LI5 2484ae3c3b81170f75e6ee512c04e14a.exe -
Modifies registry class 4 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{99775875-CABF0019-E35A976B-94476C72}\ = 9fd58cda1907223fc212af7f666d0100086d456047073aca2f8662cb71b9101745ba28167dbb2c1161784c57603a4317d68ac4a0f6d3ab89c1e4dcd88c8fbc5d6df31ceecd2283cf461d0b701e9b734e26bddbd0490098ae4a9da773a559484807fd15eff802ac0f7d421019fb74d15b384e2d1d5c0c33a1a6bbcb29393c97d1cacbd826f475e9a4a3e64e55fd08ef61fdf0ac6ede838df9e3d3d68ec4a2ca086d1b13b6c6a4ab36991b37ce2ac2bf11ad3c7c126dc180bbc95667751a9849881c9e8f8c7d43ac0e5e3d8d90bf7e5293794190f8ff506dfb5f2eb263a6ae654268509d8ff09d1c70b35b618e98ddf273d8618b98c1f4cc67a02a739e160d4b9cfe0e6ca2bfc12d23209ee94cdba3c9897bbf16d28bcede9c72b3e9e9fb982e3243efdec2b2001612b5795b28b67b9a2eb05d9870756ed4433516a8cbfaa1e99bfb0e917d80ac203ec5131889c9844476a764ca55c0f87492d6370baa9e2673b4d629c480d4d4b507a78a15b804d5d987f7faea9666fb759157340a95190bb7fe9a6c0ebdc32c1eff336d21bcec6ca2838979c3e8ae5a1ccfb1022397b6b5141b45f6641a250f2b22fe095207f60a552748fae557778aeae1de2732ea1106f414d445fb3491557c48ef393dd0ec7e40538b7639155048bb63d14970245975f0649f55cd785f2932c4e1b5b0a790253e58edf1ff5b6d8e20dc85333be6ae0b225eb78d154374695744752968c4fd94eff70265e118df8942503258c997a9fbc68f9ae375bfcae0fef74fa4a585e9d6cdd7ef9baddb32007028f9e1834352ac77c6d596ea4160e7213ab8d1d67005a3b8f6ae1a3cc92fe3e2f1af67bd6a6f95c2487699a5f054ecfb4016f4bb65d14800a559f8b056de7a0dd1608bc721f5c41b2436c71b15f6c89526772b1a06c93b8456647517d80ab5591b4c8e032216897b1b2e8ebd226f694284f9f9d757f50ad4414ae3199ef44c9401bb38d16db40064c52547645af689956377695a40f1f5a7972a0a81793790da700e973cf56ddb00765ddb3071595f4cb221900c419d5cf04f6afdff901206bf5bedf6fc6aacb980eb27065afbce2ea363318e541cf54f6b82a6e00403399ed473cad6183a33d1de438db683d4613b1096c78a8a20780f51c284b1b6e39b79c92ca4ff5892f2761f65b2b8a6ae15dd048f6502348f67fd2a2c87633596943a3428956178149745fa34d0557c781329b61824f1f994177a7a2f97e24ab78165e878e6edb4df973205d714c58ae44776aa658157a73a4517d8b50a98414ea41d47707ae4a999a47344160b3b466e055df8cc544049cd44c36b79e1ef8402188f7142e497b6fa25d04442ab27398a6c205daa70df2fcd22a09192b73e5a2c499d44f309511c048d9ba30916847b18e98f8042308f63bdd6ac4aa09fa20da03c7bef2e9d3df0ac669ecb0c3e2153b0869004323be9d6fbb42ea6dd55cf08e227484a7d076fea4266d7bbf511d707ba7a96d1cb8499264c95e107f3aa1e5833ca16214ba4065bf5cea7e2ea37be1a6d491c3c3291effc7d6c90dfc8cdf81c514d08c061c02014aa7b41d658ca8b39a16c9bddb1cf543d391014ff45ed7be0d64c747de9901c848dd4c3b91ed3738eeee2a2a73ef5ed982330ee5b42f6d69a7b3156608bfafe916c3b5ca98fc4fd2810857957a8ba1a90c9b407d77af56fa7c29abfce2de2e05ffdf22f501db130df5332419130bf5b520e3f5d5230f967974a3a016f13a2f6285445c6a84b2446dbe57167649aab0881fba711ca40be852c74c35511b808d3e341ae739cd60cba1eefb37d9110cbf946d74b0ade017254a9f703d5213b4c56fd8bac1e1c33cf6ee2032866006569681c2173085e417247112a3c676d2a7cbf132d06bca52c6b7da650a43f55d27846ad9ba0365ed54c777f5a128f00bdf590a7bc6a6e01dd287399a6b34b29fe2452b5c1970b7a7e29937c312f60bda3103ecfed7d7f6c529f818d70bc6bec7e812d673cd5edc4a03680142409e900df2b4d3920d0ef48e28740254714bab66e9b7c09adc0ff0d520009f19f9732caa7980571d8d40c367d955087f5159807ceaa62be2712aa08df9b0d89bfdb92b648da40c9bbe3e98940e479f8d0d44685d5ab3b39a92ca0fd32ace182041ec9321ca9f1a75015bb44eeb5fc586c77de5a7337562acbe7415afcf1d0573c752dd8208c251e1bcdf6c39a0e493d382c1561b854aa3926680503f4b6952af759aa8c06c2e53ff49228b01c17313a20a91de070641315cef462946f45a2287eff93adf97cd3514ecffde2530e713cd02dbc60d350b1311b60b64d543cc8edd9bf0badde3ccc13e27e58d377f95a6b31c1542849a147403acb6f01428c497c589309b11ca78db59f68f2236eee7c9cd3b389d11f84b246160b756664ea297f2752faf95653caf607ea8a4067d68a4bc17e37adea80c6422a4e79a394f9f51067bd7593e4fe7a92d1c9cbdb26f175e8e486c6657ae42f2462bbc8699f804dca7ce0d35189f8581077cbd519b83452db07b6fae4afb9bd57ecc5e2e45ee633ea5e780d6d9ca0724f61a2909080859ddb8fc99d44cc17fe7a6cd7fe756da4bcfaefe81d7bb32ea6bc0a53e14ed8e20a8706456b0826c575a424b6891a1f0fb2a226b6ab1a390994e045f2b8e79655f544a7ab0a615fb0b2d2103105acd8e2f0e12acf79bd94ec05a004319bacce3e7c92d3cfc9dd64f31be6b14a50014dd8ff8a92874ec51deb30666de55c77cfaaa2f8002997804ad2a7c19593b84eee3ddc6c71fd24af4702fab7ae15038ba63e1a938e3123abc61e3bb36e2183a7212a5ce773452694cb3661db643148541fb53268a099b3b3619638f46fabdd598cf37cde6d32a0e180338329e138ac6d2243e71eea0d007cc72dd5dcf74e9a6376611b6436f9e5d7640a9bf909283c07ef7add290c807f3ed253be762c2be1e6d7a50af7f9aaeb3e3e932d09fc78aeab823e19d308069f3b8d6e00030b768665aa38f9146bb706d56b4bd93eb4d328be6352ee419ca84f414278f6ababa64144240529549f3b72d667859aeb4ebea352e137202af5b928af3b025679cbd3f9b6175a3a37d1eacfdf020d071f0572c8196270ee553d08ace34351b6849a18f1f35719754c947f88d2a040919dfb4fd1c27858ef8b1d06f00b26a6d58a0be7c6452a083f85d257f84ad7e745e54818bf0fad62c3296e445d39f0906cc5bf6b2dc6fc2b507e81930009e51c348c5b7f7152ecf85cefb31d16333b6696fb8aae390228b7a16a939906b37be6966a7a3fa992df3632aad73f0a92790690cb7239912fb302d9494c2063d3968ecbc219894c03c3fed9ed74431956b37a5617750aa8bebeadd223b11eeff3a2e9c627c51aab09993c3451194488158448e723558e7722da49765c9b330e29c3fc0e527d8190c7362a65c158ef4d226019dac88f845dc730451734859948337daed322c69fc40de45cbb8d51c3ff46121b81b14020bbd3a9069c358e546237095a20776f5a424939e76c8a010068697f846d6b5c46f15beff1dde0b03cd42eb743152e4883c5d1a77f7ad211c8f422da0976dc2bce9e033216a9fb3ba9aea7637adee90c04fd4b1361f6285a23f04617358ae89ebe0ded2063631edecd 2484ae3c3b81170f75e6ee512c04e14a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{99775875-CABF0019-E35A976B-94476C72} 2484ae3c3b81170f75e6ee512c04e14a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{99775875-CABF0019-E35A976B-94476C72}\ = 83bd4f481907223fc212af7f666d0100086d456047073aca2f8662cb71b9101745ba28167dbb2c1161784c57603a4317d68ac4a0f6d3ab89c1e4dcd88c8fbc5d6df31ceecd2283cf461d0b701e9b734e26bddbd0490098ae4a9da773a559484807fd15eff802ac0f7d421019fb74d15b384e2d1d5c0c33a1a6bbcb29393c97d1cacbd826f475e9a4a3e64e55fd08ef61fdf0ac6ede838df9e3d3d68ec4a2ca086a1b13b6c6a4ab36991b37ce2ac2bf11ad3c7c126dc180bbc95667751a9849881c9e8f8c7d43ac0e5e3d8d90bf7e5293794190f8ff506dfb5f2eb263a6ae654268509d8ff09d1c70b35b618e98ddf273d8618b98c1f4cc67a02a739e160d4b9cfe0e6ca2bfc12d23209ee94cdba3c9897bbf16d28bcede9c72b3e9e9fb982e3243efdec2b2001612b5795b28b67b9a2eb05d9870756ed4433516a8cbfaa1e99bfb0e917d80ac203ec5131889c9844476a764ca55c0f87492d6370baa9e2673b4d629c480d4d4b507a78a15b804d5d987f7faea9666fb759157340a95190bb7fe9a6c0ebdc32c1eff336d21bcec6ca2838979c3e8ae5a1ccfb1022397b6b5141b45f6641a250f2b22fe095207f60a552748fae557778aeae1de2732ea1106f414d445fb3491557c48ef393dd0ec7e40538b7639155048bb63d14970245975f0649f55cd785f2932c4e1b5b0a790253e58edf1ff5b6d8e20dc85333be6ae0b225eb78d154374695744752968c4fd94eff70265e118dff838523258c997a9fbc68f9ae375bfcae0fef74fa4a585e9d6cdd7ef9baddb32007028f9e1834352ac77c6d596ea4160e7213ab8d1d67005a3b8f6ae1a3cc92fe3e2f1af67bd6a6f95c2487699a5f054ecfb4016f4bb65d14800a559f8b056de7a0dd1608bc721f5c41b2436c71b15f6c89526772b1a06c93b8456647517d80ab5591b4c8e032216897b1b2e8ebd226f694284f9f9d757f50ad4414ae3199ef44c9401bb38d16db40064c52547645af689956377695a40f1f5a7972a0a81793790da700e973cf56ddb00765ddb3071595f4cb221900c419d5cf04f6afdff901206bf5bedf6fc6aacb980eb27065afbce2ea363318e541cf54f6b82a6e00403399ed473cad6183a33d1de438db683d4613b1096c78a8a20780f51c284b1b6e39b79c92ca4ff5892f2761f65b2b8a6ae15dd048f6502348f67fd2a2c87633596943a3428956178149745fa34d0557c781329b61824f1f994177a7a2f97e24ab78165e878e6edb4df973205d714c58ae44776aa658157a73a4517d8b50a98414ea41d47707ae4a999a47344160b3b466e055df8cc544049cd44c36b79e1ef8402188f7142e497b6fa25d04442ab27398a6c205daa70df2fcd22a09192b73e5a2c499d44f309511c048d9ba30916847b18e98f8042308f63bdd6ac4aa09fa20da03c7bef2e9d3df0ac669ecb0c3e2153b0869004323be9d6fbb42ea6dd55cf08e227484a7d076fea4266d7bbf511d707ba7a96d1cb8499264c95e107f3aa1e5833ca16214ba4065bf5cea7e2ea37be1a6d491c3c3291effc7d6c90dfc8cdf81c514d08c061c02014aa7b41d658ca8b39a16c9bddb1cf543d391014ff45ed7be0d64c747de9901c848dd4c3b91ed3738eeee2a2a73ef5ed982330ee5b42f6d69a7b3156608bfafe916c3b5ca98fc4fd2810857957a8ba1a90c9b407d77af56fa7c29abfce2de2e05ffdf22f501db130df5332419130bf5b520e3f5d5230f967974a3a016f13a2f6285445c6a84b2446dbe57167649aab0881fba711ca40be852c74c35511b808d3e341ae739cd60cba1eefb37d9110cbf946d74b0ade017254a9f703d5213b4c56fd8bac1e1c33cf6ee2032866006569681c2173085e417247112a3c676d2a7cbf132d06bca52c6b7da650a43f55d27846ad9ba0365ed54c777f5a128f00bdf590a7bc6a6e01dd287399a6b34b29fe2452b5c1970b7a7e29937c312f60bda3103ecfed7d7f6c529f818d70bc6bec7e812d673cd5edc4a03680142409e900df2b4d3920d0ef48e28740254714bab66e9b7c09adc0ff0d520009f19f9732caa7980571d8d40c367d955087f5159807ceaa62be2712aa08df9b0d89bfdb92b648da40c9bbe3e98940e479f8d0d44685d5ab3b39a92ca0fd32ace182041ec9321ca9f1a75015bb44eeb5fc586c77de5a7337562acbe7415afcf1d0573c752dd8208c251e1bcdf6c39a0e493d382c1561b854aa3926680503f4b6952af759aa8c06c2e53ff49228b01c17313a20a91de070641315cef462946f45a2287eff93adf97cd3514ecffde2530e713cd02dbc60d350b1311b60b64d543cc8edd9bf0badde3ccc13e27e58d377f95a6b31c1542849a147403acb6f01428c497c589309b11ca78db59f68f2236eee7c9cd3b389d11f84b246160b756664ea297f2752faf95653caf607ea8a4067d68a4bc17e37adea80c6422a4e79a394f9f51067bd7593e4fe7a92d1c9cbdb26f175e8e486c6657ae42f2462bbc8699f804dca7ce0d35189f8581077cbd519b83452db07b6fae4afb9bd57ecc5e2e45ee633ea5e780d6d9ca0724f61a2909080859ddb8fc99d44cc17fe7a6cd7fe756da4bcfaefe81d7bb32ea6bc0a53e14ed8e20a8706456b0826c575a424b6891a1f0fb2a226b6ab1a390994e045f2b8e79655f544a7ab0a615fb0b2d2103105acd8e2f0e12acf79bd94ec05a004319bacce3e7c92d3cfc9dd64f31be6b14a50014dd8ff8a92874ec51deb30666de55c77cfaaa2f8002997804ad2a7c19593b84eee3ddc6c71fd24af4702fab7ae15038ba63e1a938e3123abc61e3bb36e2183a7212a5ce773452694cb3661db643148541fb53268a099b3b3619638f46fabdd598cf37cde6d32a0e180338329e138ac6d2243e71eea0d007cc72dd5dcf74e9a6376611b6436f9e5d7640a9bf909283c07ef7add290c807f3ed253be762c2be1e6d7a50af7f9aaeb3e3e932d09fc78aeab823e19d308069f3b8d6e00030b768665aa38f9146bb706d56b4bd93eb4d328be6352ee419ca84f414278f6ababa64144240529549f3b72d667859aeb4ebea352e137202af5b928af3b025679cbd3f9b6175a3a37d1eacfdf020d071f0572c8196270ee553d08ace34351b6849a18f1f35719754c947f88d2a040919dfb4fd1c27858ef8b1d06f00b26a6d58a0be7c6452a083f85d257f84ad7e745e54818bf0fad62c3296e445d39f0906cc5bf6b2dc6fc2b507e81930009e51c348c5b7f7152ecf85cefb31d16333b6696fb8aae390228b7a16a939906b37be6966a7a3fa992df3632aad73f0a92790690cb7239912fb302d9494c2063d3968ecbc219894c03c3fed9ed74431956b37a5617750aa8bebeadd223b11eeff3a2e9c627c51aab09993c3451194488158448e723558e7722da49765c9b330e29c3fc0e527d8190c7362a65c158ef4d226019dac88f845dc730451734859948337daed322c69fc40de45cbb8d51c3ff46121b81b14020bbd3a9069c358e546237095a20776f5a424939e76c8a010068697f846d6b5c46f15beff1dde0b03cd42eb743152e4883c5d1a77f7ad211c8f422da0976dc2bce9e033216a9fb3ba9aea7637adee90c04fd4b1361f6285a23f04617358ae89ebe0ded2063631edecd 2484ae3c3b81170f75e6ee512c04e14a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{99775875-CABF0019-E35A976B-94476C72}\ = 61fcef701907223fc212af7f666d0100086d456047073aca2f8662cb71b9101745ba28167dbb2c1161784c57603a4317d68ac4a0f6d3ab89c1e4dcd88c8fbc5d6df31ceecd2283cf461d0b701e9b734e26bddbd0490098ae4a9da773a559484807fd15eff802ac0f7d421019fb74d15b384e2d1d5c0c33a1a6bbcb29393c97d1cacbd826f475e9a4a3e64e55fd08ef61fdf0ac6ede838df9e3d3d68ec4a2ca086a1b13b6c6a4ab36991b37ce2ac2bf11ad3c7c126dc180bbc95667751a9849881c9e8f8c7d43ac0e5e3d8d90bf7e5293794190f8ff506dfb5f2eb263a6ae654268509d8ff09d1c70b35b618e98ddf273d8618b98c1f4cc67a02a739e160d4b9cfe0e6ca2bfc12d23209ee94cdba3c9897bbf16d28bcede9c72b3e9e9fb982e3243efdec2b2001612b5795b28b67b9a2eb05d9870756ed4433516a8cbfaa1e99bfb0e917d80ac203ec5131889c9844476a764ca55c0f87492d6370baa9e2673b4d629c480d4d4b507a78a15b804d5d987f7faea9666fb759157340a95190bb7fe9a6c0ebdc32c1eff336d21bcec6ca2838979c3e8ae5a1ccfb1022397b6b5141b45f6641a250f2b22fe095207f60a552748fae557778aeae1de2732ea1106f414d445fb3491557c48ef393dd0ec7e40538b7639155048bb63d14970245975f0649f55cd785f2932c4e1b5b0a790253e58edf1ff5b6d8e20dc85333be6ae0b225eb78d154374695744752968c4fd94eff70265e118df8942503258c997a9fbc68f9ae375bfcae0fef74fa4a585e9d6cdd7ef9baddb32007028f9e1834352ac77c6d596ea4160e7213ab8d1d67005a3b8f6ae1a3cc92fe3e2f1af67bd6a6f95c2487699a5f054ecfb4016f4bb65d14800a559f8b056de7a0dd1608bc721f5c41b2436c71b15f6c89526772b1a06c93b8456647517d80ab5591b4c8e032216897b1b2e8ebd226f694284f9f9d757f50ad4414ae3199ef44c9401bb38d16db40064c52547645af689956377695a40f1f5a7972a0a81793790da700e973cf56ddb00765ddb3071595f4cb221900c419d5cf04f6afdff901206bf5bedf6fc6aacb980eb27065afbce2ea363318e541cf54f6b82a6e00403399ed473cad6183a33d1de438db683d4613b1096c78a8a20780f51c284b1b6e39b79c92ca4ff5892f2761f65b2b8a6ae15dd048f6502348f67fd2a2c87633596943a3428956178149745fa34d0557c781329b61824f1f994177a7a2f97e24ab78165e878e6edb4df973205d714c58ae44776aa658157a73a4517d8b50a98414ea41d47707ae4a999a47344160b3b466e055df8cc544049cd44c36b79e1ef8402188f7142e497b6fa25d04442ab27398a6c205daa70df2fcd22a09192b73e5a2c499d44f309511c048d9ba30916847b18e98f8042308f63bdd6ac4aa09fa20da03c7bef2e9d3df0ac669ecb0c3e2153b0869004323be9d6fbb42ea6dd55cf08e227484a7d076fea4266d7bbf511d707ba7a96d1cb8499264c95e107f3aa1e5833ca16214ba4065bf5cea7e2ea37be1a6d491c3c3291effc7d6c90dfc8cdf81c514d08c061c02014aa7b41d658ca8b39a16c9bddb1cf543d391014ff45ed7be0d64c747de9901c848dd4c3b91ed3738eeee2a2a73ef5ed982330ee5b42f6d69a7b3156608bfafe916c3b5ca98fc4fd2810857957a8ba1a90c9b407d77af56fa7c29abfce2de2e05ffdf22f501db130df5332419130bf5b520e3f5d5230f967974a3a016f13a2f6285445c6a84b2446dbe57167649aab0881fba711ca40be852c74c35511b808d3e341ae739cd60cba1eefb37d9110cbf946d74b0ade017254a9f703d5213b4c56fd8bac1e1c33cf6ee2032866006569681c2173085e417247112a3c676d2a7cbf132d06bca52c6b7da650a43f55d27846ad9ba0365ed54c777f5a128f00bdf590a7bc6a6e01dd287399a6b34b29fe2452b5c1970b7a7e29937c312f60bda3103ecfed7d7f6c529f818d70bc6bec7e812d673cd5edc4a03680142409e900df2b4d3920d0ef48e28740254714bab66e9b7c09adc0ff0d520009f19f9732caa7980571d8d40c367d955087f5159807ceaa62be2712aa08df9b0d89bfdb92b648da40c9bbe3e98940e479f8d0d44685d5ab3b39a92ca0fd32ace182041ec9321ca9f1a75015bb44eeb5fc586c77de5a7337562acbe7415afcf1d0573c752dd8208c251e1bcdf6c39a0e493d382c1561b854aa3926680503f4b6952af759aa8c06c2e53ff49228b01c17313a20a91de070641315cef462946f45a2287eff93adf97cd3514ecffde2530e713cd02dbc60d350b1311b60b64d543cc8edd9bf0badde3ccc13e27e58d377f95a6b31c1542849a147403acb6f01428c497c589309b11ca78db59f68f2236eee7c9cd3b389d11f84b246160b756664ea297f2752faf95653caf607ea8a4067d68a4bc17e37adea80c6422a4e79a394f9f51067bd7593e4fe7a92d1c9cbdb26f175e8e486c6657ae42f2462bbc8699f804dca7ce0d35189f8581077cbd519b83452db07b6fae4afb9bd57ecc5e2e45ee633ea5e780d6d9ca0724f61a2909080859ddb8fc99d44cc17fe7a6cd7fe756da4bcfaefe81d7bb32ea6bc0a53e14ed8e20a8706456b0826c575a424b6891a1f0fb2a226b6ab1a390994e045f2b8e79655f544a7ab0a615fb0b2d2103105acd8e2f0e12acf79bd94ec05a004319bacce3e7c92d3cfc9dd64f31be6b14a50014dd8ff8a92874ec51deb30666de55c77cfaaa2f8002997804ad2a7c19593b84eee3ddc6c71fd24af4702fab7ae15038ba63e1a938e3123abc61e3bb36e2183a7212a5ce773452694cb3661db643148541fb53268a099b3b3619638f46fabdd598cf37cde6d32a0e180338329e138ac6d2243e71eea0d007cc72dd5dcf74e9a6376611b6436f9e5d7640a9bf909283c07ef7add290c807f3ed253be762c2be1e6d7a50af7f9aaeb3e3e932d09fc78aeab823e19d308069f3b8d6e00030b768665aa38f9146bb706d56b4bd93eb4d328be6352ee419ca84f414278f6ababa64144240529549f3b72d667859aeb4ebea352e137202af5b928af3b025679cbd3f9b6175a3a37d1eacfdf020d071f0572c8196270ee553d08ace34351b6849a18f1f35719754c947f88d2a040919dfb4fd1c27858ef8b1d06f00b26a6d58a0be7c6452a083f85d257f84ad7e745e54818bf0fad62c3296e445d39f0906cc5bf6b2dc6fc2b507e81930009e51c348c5b7f7152ecf85cefb31d16333b6696fb8aae390228b7a16a939906b37be6966a7a3fa992df3632aad73f0a92790690cb7239912fb302d9494c2063d3968ecbc219894c03c3fed9ed74431956b37a5617750aa8bebeadd223b11eeff3a2e9c627c51aab09993c3451194488158448e723558e7722da49765c9b330e29c3fc0e527d8190c7362a65c158ef4d226019dac88f845dc730451734859948337daed322c69fc40de45cbb8d51c3ff46121b81b14020bbd3a9069c358e546237095a20776f5a424939e76c8a010068697f846d6b5c46f15beff1dde0b03cd42eb743152e4883c5d1a77f7ad211c8f422da0976dc2bce9e033216a9fb3ba9aea7637adee90c04fd4b1361f6285a23f04617358ae89ebe0ded2063631edecd 2484ae3c3b81170f75e6ee512c04e14a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2632 2484ae3c3b81170f75e6ee512c04e14a.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2632 wrote to memory of 4868 2632 2484ae3c3b81170f75e6ee512c04e14a.exe 91 PID 2632 wrote to memory of 4868 2632 2484ae3c3b81170f75e6ee512c04e14a.exe 91 PID 2632 wrote to memory of 4868 2632 2484ae3c3b81170f75e6ee512c04e14a.exe 91 PID 2632 wrote to memory of 4868 2632 2484ae3c3b81170f75e6ee512c04e14a.exe 91 PID 2632 wrote to memory of 4868 2632 2484ae3c3b81170f75e6ee512c04e14a.exe 91 PID 2632 wrote to memory of 4868 2632 2484ae3c3b81170f75e6ee512c04e14a.exe 91 PID 2632 wrote to memory of 4868 2632 2484ae3c3b81170f75e6ee512c04e14a.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2484ae3c3b81170f75e6ee512c04e14a.exe"C:\Users\Admin\AppData\Local\Temp\2484ae3c3b81170f75e6ee512c04e14a.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\2484ae3c3b81170f75e6ee512c04e14a.exeC:\Users\Admin\AppData\Local\Temp\2484ae3c3b81170f75e6ee512c04e14a.exe2⤵PID:4868
-