9ecbf28720a944bdd3f3c20cdb3f4da7f40da903b651be520348e01a8efa2504

Analysis

max time kernel
130s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
13-04-2024 17:32

Target

kayflock-beta/packages/ranks/winhlp32.exe
Size

11KB
MD5

0629e6d130f226c009ea9ab329f37acc
SHA1

1529c6cf3265311b690992dc975443b35177bc7c
SHA256

4fce997bdd3475c42ba856d8c288fd4f9f91fd1370075ad7e0b11b1e71ae69ce
SHA512

a36f25cd5b79891f0cc5a8e85636ce4ef10c91ec6d6c7c0f5c5b622d0af1f4f400c864d331caffaa8a51d9a2734777b5b9ce87cabb7667a9aceaf8837e88c847
SSDEEP

192:ZomhYgSgGvZx5qdoth1Pdk7WneHWGhh4j8q05:L67gGnP7q7WneHWGhh44q

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

helppane.exe

pid process

5020 helppane.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

helppane.exe

pid process

5020 helppane.exe
5020 helppane.exe

pid	process
5020	helppane.exe

pid	process
5020	helppane.exe
5020	helppane.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

helppane.exe

description	pid	process	target process
PID 5020 wrote to memory of 4372	5020	helppane.exe	msedge.exe
PID 5020 wrote to memory of 4372	5020	helppane.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\kayflock-beta\packages\ranks\winhlp32.exe
"C:\Users\Admin\AppData\Local\Temp\kayflock-beta\packages\ranks\winhlp32.exe"
1⤵
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
2⤵
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=3860,i,7447082786332118630,10839110169592584063,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
1⤵
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5608,i,7447082786332118630,10839110169592584063,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
1⤵
PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=4080,i,7447082786332118630,10839110169592584063,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
1⤵
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=3564,i,7447082786332118630,10839110169592584063,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
1⤵
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5444,i,7447082786332118630,10839110169592584063,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
1⤵
PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=5960,i,7447082786332118630,10839110169592584063,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
1⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=4520,i,7447082786332118630,10839110169592584063,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:8
1⤵
PID:3420