0b68025a249bd04720540f688c58ba4bd3f6782de8119524eccfb57fcac36d13

Analysis

max time kernel
136s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 09:31

Target

iphone_photo_id_8237489237982.exe
Size

140KB
MD5

8b9aa1589fea77caa7a1b17a3c4617f2
SHA1

a9a22fdf9ed8cd9496da748b97881fadf249243b
SHA256

dc2ade64db04b2da7bd825d842025deae7ebb43419a727435962cb093d4299b6
SHA512

8d0e59d61fae6404de9b75cbb28bfb299df29522536f33da188ab7931a5abc3568e0f8f6e7b72ceddad06020f8de0cf0bdb00609ec44404934ef573d6dd79cc0
SSDEEP

1536:nRnAIQv9JBWd+FZLVZ0pPgS7vTho6lxr0+6Lbd+FeBEG5QsMNZM3tPDoH:6jBWdWZwThoGrNudrBTQHZMVD

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 760 set thread context of 1124	760	iphone_photo_id_8237489237982.exe	98

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
760	iphone_photo_id_8237489237982.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 1124	760	iphone_photo_id_8237489237982.exe	98
PID 760 wrote to memory of 1124	760	iphone_photo_id_8237489237982.exe	98
PID 760 wrote to memory of 1124	760	iphone_photo_id_8237489237982.exe	98
PID 760 wrote to memory of 1124	760	iphone_photo_id_8237489237982.exe	98
PID 760 wrote to memory of 1124	760	iphone_photo_id_8237489237982.exe	98
PID 760 wrote to memory of 1124	760	iphone_photo_id_8237489237982.exe	98
PID 760 wrote to memory of 1124	760	iphone_photo_id_8237489237982.exe	98

C:\Users\Admin\AppData\Local\Temp\iphone_photo_id_8237489237982.exe
"C:\Users\Admin\AppData\Local\Temp\iphone_photo_id_8237489237982.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\iphone_photo_id_8237489237982.exe
  "C:\Users\Admin\AppData\Local\Temp\iphone_photo_id_8237489237982.exe"
  2⤵
  PID:1124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1956 --field-trial-handle=2268,i,4334050275411101233,11484630688883830558,262144 --variations-seed-version /prefetch:8
1⤵
PID:2756

memory/1124-2-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download