dc2060e286f48048f8a12ed332bdfa12b3c53692beb06ebfa4d774009b272e56

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 21:06

Target

549422597b561cd4aab5dcdb810b2776.exe
Size

1.9MB
MD5

549422597b561cd4aab5dcdb810b2776
SHA1

5be64f8c3e2a0d6c0d9de93ef76dd6d0c8a6e0f1
SHA256

dc2060e286f48048f8a12ed332bdfa12b3c53692beb06ebfa4d774009b272e56
SHA512

332696bc3bfc44429f6386ea0ea253286f5608b9ed35dfe71551f6fa80780b3cf230858134ff212e0f01a2e2cc5ef581b78b2682cd5819f1396243cb55b2f002
SSDEEP

24576:N0fV6Lz9F0Yup//qA8EdXmX+5dqDGUSxCtxRMfaFIS/chlYJALELQgDWh0RWxKk:2fV6LzYdX7BdXmXYFXIx0anqh0I

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4876	Sky829.tmp.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 4876	3376	549422597b561cd4aab5dcdb810b2776.exe	92
PID 3376 wrote to memory of 4876	3376	549422597b561cd4aab5dcdb810b2776.exe	92
PID 3376 wrote to memory of 4876	3376	549422597b561cd4aab5dcdb810b2776.exe	92

C:\Users\Admin\AppData\Local\Temp\549422597b561cd4aab5dcdb810b2776.exe
"C:\Users\Admin\AppData\Local\Temp\549422597b561cd4aab5dcdb810b2776.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Users\Admin\AppData\Local\Temp\Sky829.tmp.EXE
  "C:\Users\Admin\AppData\Local\Temp\Sky829.tmp.EXE" 001042700063
  2⤵
  - Executes dropped EXE
  PID:4876

C:\Users\Admin\AppData\Local\Temp\Sky829.tmp.EXE

Filesize
148KB

MD5
bfef9fc1435d730aaa1bf2a9ce13832b

SHA1
bd27bc0d5edab52c17a66befa59ce44411a4419d

SHA256
79f0bcfaee082a83e0b3e10f1bd567c98ac135cc15cb6e14c2a734b5f6f8fe10

SHA512
1316db558a3a4c58e1e348c661a8d4ea8a9ae03fb986cb5a1e81c5a642f2cec1cec22e30a701e23fd42118e1981c3915c40395663ff983d89dd85bbacb963a07

Download Submit
memory/3376-0-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/3376-13-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download