721369c03bfbc6af2abb7e02e6e5aff0a5b0ff4ae370e73e66a7f91479109d38

Analysis

max time kernel
147s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 08:34

Target

501717a8fbacfddb814c4d20b9d30c78.exe
Size

32KB
MD5

501717a8fbacfddb814c4d20b9d30c78
SHA1

b3bcee84379c353dff627f729fea117ee1450f55
SHA256

721369c03bfbc6af2abb7e02e6e5aff0a5b0ff4ae370e73e66a7f91479109d38
SHA512

a112a842fdf377f52e12f1669248825ce26416b0baf8831ccf9a9d32764df80e8e31da34d5267f4d57f8bcb0af2f193560d5130750c6d7698b71852f68790de5
SSDEEP

384:HM9D5XJCQs+hjVzBlhT9DcSvWMQHZ4M4urwz4Gr0X3tsftB+Ohkty3D948X:HMV5Xrs+vJaSOKL0fsy8

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1492	501717a8fbacfddb814c4d20b9d30c78.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 4712	1492	501717a8fbacfddb814c4d20b9d30c78.exe	21
PID 1492 wrote to memory of 4712	1492	501717a8fbacfddb814c4d20b9d30c78.exe	21
PID 1492 wrote to memory of 4712	1492	501717a8fbacfddb814c4d20b9d30c78.exe	21

C:\Users\Admin\AppData\Local\Temp\501717a8fbacfddb814c4d20b9d30c78.exe
"C:\Users\Admin\AppData\Local\Temp\501717a8fbacfddb814c4d20b9d30c78.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c n.bat
  2⤵
  PID:4712