f0d2d8e34a070a9ad7b2a7ae67c166d50e6724477745bec5c663e0ef61f39fda

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 16:01

Target

680bf2c4cc6ce379a2b0d77e6b378f32.exe
Size

76KB
MD5

680bf2c4cc6ce379a2b0d77e6b378f32
SHA1

0aed1d8d092bcb2f1ed3aaffd3c18913e1069977
SHA256

f0d2d8e34a070a9ad7b2a7ae67c166d50e6724477745bec5c663e0ef61f39fda
SHA512

353e70865d298af94acba7adfb92f7566f5b38aefb331a7d964067c64819df9cab49e3638fb5842f4d894fcbf48fa575ecc0be499885a089e9445c8974418e90
SSDEEP

1536:qGe4AF4erdNnCiJbnuxcIVuGA+s5U5CJk:q1FtrdNCiJuMAs5c5

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\System32\drivers\etc\hosts	680bf2c4cc6ce379a2b0d77e6b378f32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\winlogin.exe	680bf2c4cc6ce379a2b0d77e6b378f32.exe
File opened for modification	C:\WINDOWS\SysWOW64\winlogin.exe	680bf2c4cc6ce379a2b0d77e6b378f32.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2348 set thread context of 4556	2348	680bf2c4cc6ce379a2b0d77e6b378f32.exe	88
PID 4556 set thread context of 1708	4556	680bf2c4cc6ce379a2b0d77e6b378f32.exe	89

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\winrun.exe	680bf2c4cc6ce379a2b0d77e6b378f32.exe
File opened for modification	C:\WINDOWS\winrun.exe	680bf2c4cc6ce379a2b0d77e6b378f32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1708	680bf2c4cc6ce379a2b0d77e6b378f32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 4556	2348	680bf2c4cc6ce379a2b0d77e6b378f32.exe	88
PID 2348 wrote to memory of 4556	2348	680bf2c4cc6ce379a2b0d77e6b378f32.exe	88
PID 2348 wrote to memory of 4556	2348	680bf2c4cc6ce379a2b0d77e6b378f32.exe	88
PID 2348 wrote to memory of 4556	2348	680bf2c4cc6ce379a2b0d77e6b378f32.exe	88
PID 2348 wrote to memory of 4556	2348	680bf2c4cc6ce379a2b0d77e6b378f32.exe	88
PID 2348 wrote to memory of 4556	2348	680bf2c4cc6ce379a2b0d77e6b378f32.exe	88
PID 2348 wrote to memory of 4556	2348	680bf2c4cc6ce379a2b0d77e6b378f32.exe	88
PID 2348 wrote to memory of 4556	2348	680bf2c4cc6ce379a2b0d77e6b378f32.exe	88
PID 4556 wrote to memory of 1708	4556	680bf2c4cc6ce379a2b0d77e6b378f32.exe	89
PID 4556 wrote to memory of 1708	4556	680bf2c4cc6ce379a2b0d77e6b378f32.exe	89
PID 4556 wrote to memory of 1708	4556	680bf2c4cc6ce379a2b0d77e6b378f32.exe	89
PID 4556 wrote to memory of 1708	4556	680bf2c4cc6ce379a2b0d77e6b378f32.exe	89
PID 4556 wrote to memory of 1708	4556	680bf2c4cc6ce379a2b0d77e6b378f32.exe	89
PID 4556 wrote to memory of 1708	4556	680bf2c4cc6ce379a2b0d77e6b378f32.exe	89
PID 4556 wrote to memory of 1708	4556	680bf2c4cc6ce379a2b0d77e6b378f32.exe	89
PID 4556 wrote to memory of 1708	4556	680bf2c4cc6ce379a2b0d77e6b378f32.exe	89

C:\Windows\System32\drivers\etc\hosts

Filesize
9KB

MD5
e202f42e36607b1dcdf62dbfba1327f7

SHA1
9926164e9f250c3f7d5b82b1350e9a09a1c84f06

SHA256
ffb9ca15f97e9d04e793631edef5199c0879456d5150421979f6f5211de7d59f

SHA512
ce69d7091fcca153e2b0bde83d9b41c25b5d455fcf9f10a73166b74b06d60a2564ef0e593260511cfaef49ca69bbbe01b6e5419ad8ba31b3aea590b2dc083e60

Download Submit
memory/1708-10-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1708-12-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1708-21-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1708-23-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2348-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2348-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4556-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4556-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4556-13-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download