f57cbd2e1467f98ffdbf928ab71eb3b6f7d2337416cbbe2de0df857fb01a36cb

Analysis

max time kernel
137s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:09

Target

2024-05-22_ee06a9b2a958b1ffc837a523bb4096cd_hacktools_xiaoba.exe
Size

3.2MB
MD5

ee06a9b2a958b1ffc837a523bb4096cd
SHA1

07221ef53ab98dc79bcde72ae260e473273ad8ab
SHA256

f57cbd2e1467f98ffdbf928ab71eb3b6f7d2337416cbbe2de0df857fb01a36cb
SHA512

8d9f9665448d7b24814935c9b3971ee137868ffefa44d6f38f010d4cad37a654e577b758359cec2879a57653d3b5396da6f7361fa0d9ca8f0c1cea1f7d9bcdc7
SSDEEP

49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nj:DBIKRAGRe5K2UZ/

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

e57e9c4.exe

pid process

1812 e57e9c4.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4412 1812 WerFault.exe e57e9c4.exe

pid	process
1812	e57e9c4.exe

pid	pid_target	process	target process
4412	1812	WerFault.exe	e57e9c4.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

2024-05-22_ee06a9b2a958b1ffc837a523bb4096cd_hacktools_xiaoba.exee57e9c4.exe

pid	process
3036	2024-05-22_ee06a9b2a958b1ffc837a523bb4096cd_hacktools_xiaoba.exe
3036	2024-05-22_ee06a9b2a958b1ffc837a523bb4096cd_hacktools_xiaoba.exe
1812	e57e9c4.exe
1812	e57e9c4.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_ee06a9b2a958b1ffc837a523bb4096cd_hacktools_xiaoba.exe

description	pid	process	target process
PID 3036 wrote to memory of 1812	3036	2024-05-22_ee06a9b2a958b1ffc837a523bb4096cd_hacktools_xiaoba.exe	e57e9c4.exe
PID 3036 wrote to memory of 1812	3036	2024-05-22_ee06a9b2a958b1ffc837a523bb4096cd_hacktools_xiaoba.exe	e57e9c4.exe
PID 3036 wrote to memory of 1812	3036	2024-05-22_ee06a9b2a958b1ffc837a523bb4096cd_hacktools_xiaoba.exe	e57e9c4.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4168,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1812 -ip 1812
1⤵
PID:5076

C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57e9c4.exe

Filesize
3.2MB

MD5
3e5126a40c1daddfe12471036a278e99

SHA1
8c1b49de9b455282d87a14cc57095a5a31925de3

SHA256
3569ec4f976a37b2534e6eb2c42adf68a881d99bb83635d6c1fcbc60db454659

SHA512
d840ea990d61eae45076dfa2aef3b8e1946e5635f60a3b5d3f41867fb40de09be0ae7dda07ec9dea8041c79b5d021ebd3147f85b35f5d533d86468ad231a47cb

Download Submit
memory/1812-16-0x000000007641A000-0x000000007641B000-memory.dmp

Filesize
4KB

Download
memory/1812-21-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/3036-1-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/3036-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/3036-20-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download