1bd3337a6c10520e8102e166f70981851b2e6144a3c600c23711c7de84af2b18

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 12:59

Target

31AA8EC187E1241A94127336996F9CB38719EB9B.exe
Size

404KB
MD5

226b276b333804a0a5aac78d8e11ddf0
SHA1

31aa8ec187e1241a94127336996f9cb38719eb9b
SHA256

ca805825dcaf51d1c45c71258f8ab2a67c4c880a1f252e1cd470832f7f867b54
SHA512

a9a8dc4aeea8983d62a36e892fb0d96a902e4a53742f5c0d7de9711a7bc356b84c507b8322f1bbbeb5879103ca9824653a32e0d4441227df67b179c911348e3d
SSDEEP

6144:a3sHlvDPwV6H72Hup4KZLkbQsx8wXxV1FAyaCi89T/WB8U/hcxHFCu0:/dzwVxHf4sQsx5v1FTbTOuE8HsB

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\31AA8EC187E1241A94127336996F9CB38719EB9B.exe	31AA8EC187E1241A94127336996F9CB38719EB9B.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\31AA8EC187E1241A94127336996F9CB38719EB9B.exe	31AA8EC187E1241A94127336996F9CB38719EB9B.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1572 set thread context of 3608	1572	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	95

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1572	31AA8EC187E1241A94127336996F9CB38719EB9B.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 3608	1572	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	95
PID 1572 wrote to memory of 3608	1572	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	95
PID 1572 wrote to memory of 3608	1572	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	95
PID 1572 wrote to memory of 3608	1572	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	95
PID 1572 wrote to memory of 3608	1572	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	95
PID 1572 wrote to memory of 3608	1572	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	95
PID 1572 wrote to memory of 3608	1572	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	95

C:\Users\Admin\AppData\Local\Temp\31AA8EC187E1241A94127336996F9CB38719EB9B.exe
"C:\Users\Admin\AppData\Local\Temp\31AA8EC187E1241A94127336996F9CB38719EB9B.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Users\Admin\AppData\Local\Temp\31AA8EC187E1241A94127336996F9CB38719EB9B.exe
  "C:\Users\Admin\AppData\Local\Temp\31AA8EC187E1241A94127336996F9CB38719EB9B.exe"
  2⤵
  - Drops startup file
  PID:3608

memory/3608-2-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3608-4-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3608-6-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3608-5-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3608-9-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3608-8-0x00000000006B0000-0x00000000006B2000-memory.dmp

Filesize
8KB

Download
memory/3608-11-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/3608-12-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3608-13-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3608-14-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/3608-15-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3608-18-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download