1bd3337a6c10520e8102e166f70981851b2e6144a3c600c23711c7de84af2b18

Analysis

max time kernel
150s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 12:59

Target

BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe
Size

366KB
MD5

81597a3dca5e7302766352fdcc2637a2
SHA1

ba8909eef5ee280ae43b935cf4ae38ccf21bde56
SHA256

d38d0696798fa5a27fb8ed8aa8b8a865d946aa2d7fee5c926eef97c7fee16f1a
SHA512

27050fa378b853e85302319ff7418f819abf9d8d006d426b83a5a1b2e084eacd4313e8c081a4be81f330bf2ac759ebc06fcd4c1a8aae776379a0665c311e482f
SSDEEP

6144:Ci7/WvtFHn58zLfavC+gXIqhboQInFcYy7gDEHHG+0htzeZ9wCXYHmF6UO8:nutQaK+tqmjGztoeZ9wCoHmoUF

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe	BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe	BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1344 set thread context of 3172	1344	BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe	90

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1344	BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 3172	1344	BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe	90
PID 1344 wrote to memory of 3172	1344	BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe	90
PID 1344 wrote to memory of 3172	1344	BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe	90
PID 1344 wrote to memory of 3172	1344	BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe	90
PID 1344 wrote to memory of 3172	1344	BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe	90
PID 1344 wrote to memory of 3172	1344	BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe	90
PID 1344 wrote to memory of 3172	1344	BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe	90

C:\Users\Admin\AppData\Local\Temp\BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe
"C:\Users\Admin\AppData\Local\Temp\BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Local\Temp\BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe
  "C:\Users\Admin\AppData\Local\Temp\BA8909EEF5EE280AE43B935CF4AE38CCF21BDE56.exe"
  2⤵
  - Drops startup file
  PID:3172

memory/3172-2-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/3172-4-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/3172-5-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/3172-6-0x0000000000AD0000-0x0000000000AD2000-memory.dmp

Filesize
8KB

Download
memory/3172-7-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/3172-9-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/3172-11-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/3172-12-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/3172-14-0x0000000000AD0000-0x0000000000AD2000-memory.dmp

Filesize
8KB

Download