c63376f6f8fb06b378be6f8ebe2a06593f5111725e1ee5e65f70fec0cf09c0ef

Analysis

max time kernel
137s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 09:14

Target

c63376f6f8fb06b378be6f8ebe2a06593f5111725e1ee5e65f70fec0cf09c0ef.exe
Size

36KB
MD5

a2a1c23859ce7e6993d8df79803d6221
SHA1

f7d5690407070567bba68afee660ff4327f0a563
SHA256

c63376f6f8fb06b378be6f8ebe2a06593f5111725e1ee5e65f70fec0cf09c0ef
SHA512

238e54d16eb641b3762e69b306a23677eb01001d3f291cee2c1c3b34c02a6abe33267c7919fae7b2511360f38ae96a42b66446661d9edd5012b35590a3090455
SSDEEP

192:IImMbhEVIQHSw0Mx1TTw76mpvzvOQSBZL0X4O:II9bqVjE76UmT/a

Score

1^/10

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4404	4900	c63376f6f8fb06b378be6f8ebe2a06593f5111725e1ee5e65f70fec0cf09c0ef.exe	84
PID 4900 wrote to memory of 4404	4900	c63376f6f8fb06b378be6f8ebe2a06593f5111725e1ee5e65f70fec0cf09c0ef.exe	84
PID 4900 wrote to memory of 4404	4900	c63376f6f8fb06b378be6f8ebe2a06593f5111725e1ee5e65f70fec0cf09c0ef.exe	84
PID 4404 wrote to memory of 4956	4404	wordpad.exe	85
PID 4404 wrote to memory of 4956	4404	wordpad.exe	85

C:\Users\Admin\AppData\Local\Temp\c63376f6f8fb06b378be6f8ebe2a06593f5111725e1ee5e65f70fec0cf09c0ef.exe
"C:\Users\Admin\AppData\Local\Temp\c63376f6f8fb06b378be6f8ebe2a06593f5111725e1ee5e65f70fec0cf09c0ef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
  "C:\Users\Admin\AppData\Local\Temp\c63376f6f8fb06b378be6f8ebe2a06593f5111725e1ee5e65f70fec0cf09c0ef.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:4956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:712

memory/4900-0-0x0000000000710000-0x0000000000717000-memory.dmp

Filesize
28KB

Download