9a05cccde2b1698f86bbcb0120e5ad42aeff83c05036f2403b811c1568d579c7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:32

Target

2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe
Size

3.2MB
MD5

3c4f792f54857323583530790d3ee7c0
SHA1

7fdce9555c2a54399bfcb4738ac112fdfeda7f0c
SHA256

9a05cccde2b1698f86bbcb0120e5ad42aeff83c05036f2403b811c1568d579c7
SHA512

8b02f4af0e6c7102369d9575465bc6a616b3409f0662af1860f259a2e3e6c1f3b36f6ec2cd4c0f0f30fb8ed49c7ea608c43a64ca1673351d20ffc72e24ab1ab9
SSDEEP

49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nj:DBIKRAGRe5K2UZ/

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

f7615f1.exe

pid process

1812 f7615f1.exe

pid	process
1812	f7615f1.exe

Loads dropped DLL 9 IoCs

Processes:

2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exeWerFault.exe

pid	process
2796	2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe
2796	2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2492 1812 WerFault.exe f7615f1.exe

pid	pid_target	process	target process
2492	1812	WerFault.exe	f7615f1.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exef7615f1.exe

pid	process
2796	2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe
2796	2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe
1812	f7615f1.exe
1812	f7615f1.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exef7615f1.exe

description	pid	process	target process
PID 2796 wrote to memory of 1812	2796	2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe	f7615f1.exe
PID 2796 wrote to memory of 1812	2796	2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe	f7615f1.exe
PID 2796 wrote to memory of 1812	2796	2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe	f7615f1.exe
PID 2796 wrote to memory of 1812	2796	2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe	f7615f1.exe
PID 1812 wrote to memory of 2492	1812	f7615f1.exe	WerFault.exe
PID 1812 wrote to memory of 2492	1812	f7615f1.exe	WerFault.exe
PID 1812 wrote to memory of 2492	1812	f7615f1.exe	WerFault.exe
PID 1812 wrote to memory of 2492	1812	f7615f1.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f7615f1.exe

Filesize
3.2MB

MD5
60d1c33d0719c1097131f21b900a5bab

SHA1
7edc7119c33f500a1c044606218e92104ab6ac68

SHA256
adcd52d8384e130f2d92b3107553e7e037ef471303f126e30cc75a35d7eb5918

SHA512
cea3767fb6cf635e7198d8caa379e70f898a293f0a6d437900017b47fc1bbdef04a48abe70918ff29ad5d755851a1afa8b9af1265d09b5d66b4303c9a8d89b66

Download Submit
memory/1812-12-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/1812-13-0x00000000752BD000-0x00000000752BE000-memory.dmp

Filesize
4KB

Download
memory/1812-43-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/1812-44-0x00000000752BD000-0x00000000752BE000-memory.dmp

Filesize
4KB

Download
memory/2796-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/2796-1-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/2796-11-0x0000000002BC0000-0x0000000002F65000-memory.dmp

Filesize
3.6MB

Download
memory/2796-35-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download