1bd3337a6c10520e8102e166f70981851b2e6144a3c600c23711c7de84af2b18

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 12:59

Target

4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe
Size

370KB
MD5

9146ae0009e78aa23b05850a9027a9f8
SHA1

4b356b88fb3a3dce1f009e4e92cd4a59383e0764
SHA256

20de5d0ed1402aac8bfae7b0ef4ace32a3371ba813a1fc6d3fc5ff0a8e9cab43
SHA512

ce6e0c1ea5ea47f9e81cf81f462c7c91d368a2e654794aff035cf3a9a72b6912722f81a232af826e6e6d21054c697981940ca1f26f6dfc54ce81cd90522e7f54
SSDEEP

6144:6HZ+m8oNojmtvaP4QAx9uJTrb3NZMHu3RfwAriRkrAd+cyyo0IrQb1WI:6i/PW67ZltsdGfxrQII

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe	4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe	4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3672 set thread context of 3584	3672	4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe	96

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3672	4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 3584	3672	4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe	96
PID 3672 wrote to memory of 3584	3672	4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe	96
PID 3672 wrote to memory of 3584	3672	4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe	96
PID 3672 wrote to memory of 3584	3672	4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe	96
PID 3672 wrote to memory of 3584	3672	4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe	96
PID 3672 wrote to memory of 3584	3672	4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe	96
PID 3672 wrote to memory of 3584	3672	4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe	96

C:\Users\Admin\AppData\Local\Temp\4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe
"C:\Users\Admin\AppData\Local\Temp\4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Users\Admin\AppData\Local\Temp\4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe
  "C:\Users\Admin\AppData\Local\Temp\4B356B88FB3A3DCE1F009E4E92CD4A59383E0764.exe"
  2⤵
  - Drops startup file
  PID:3584

memory/3584-2-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/3584-4-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/3584-5-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/3584-6-0x0000000000AD0000-0x0000000000AD2000-memory.dmp

Filesize
8KB

Download
memory/3584-7-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/3584-9-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/3584-11-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/3584-12-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/3584-14-0x0000000000AD0000-0x0000000000AD2000-memory.dmp

Filesize
8KB

Download