9a05cccde2b1698f86bbcb0120e5ad42aeff83c05036f2403b811c1568d579c7

Analysis

max time kernel
140s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:32

Target

2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe
Size

3.2MB
MD5

3c4f792f54857323583530790d3ee7c0
SHA1

7fdce9555c2a54399bfcb4738ac112fdfeda7f0c
SHA256

9a05cccde2b1698f86bbcb0120e5ad42aeff83c05036f2403b811c1568d579c7
SHA512

8b02f4af0e6c7102369d9575465bc6a616b3409f0662af1860f259a2e3e6c1f3b36f6ec2cd4c0f0f30fb8ed49c7ea608c43a64ca1673351d20ffc72e24ab1ab9
SSDEEP

49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nj:DBIKRAGRe5K2UZ/

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

e583c68.exe

pid process

4752 e583c68.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1276 4752 WerFault.exe e583c68.exe

pid	process
4752	e583c68.exe

pid	pid_target	process	target process
1276	4752	WerFault.exe	e583c68.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exee583c68.exe

pid	process
1480	2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe
1480	2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe
4752	e583c68.exe
4752	e583c68.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe

description	pid	process	target process
PID 1480 wrote to memory of 4752	1480	2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe	e583c68.exe
PID 1480 wrote to memory of 4752	1480	2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe	e583c68.exe
PID 1480 wrote to memory of 4752	1480	2024-05-23_3c4f792f54857323583530790d3ee7c0_hacktools_xiaoba.exe	e583c68.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 2052
3⤵
- Program crash
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4752 -ip 4752
1⤵
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:856

C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e583c68.exe
Filesize
3.2MB

MD5
2babffe321765b5f5cdb94e5bb176f2d

SHA1
ab566655eb868b7871732960d8c334d5ebded8e2

SHA256
3ad40e4aa2351f59c472d5b1ed8b76547cb42011b7805e5ce1a1153b2efb3e35

SHA512
c4c3cba2de263553ff43cf0768c42f5d3f000ed8e95c8ffd6ce77d4e7bab5bcf9c85df3bbe683eeca1ac58a7141d1341ef1c045e229ee7a86ec90f091bd363e9

Download Submit
memory/1480-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/1480-1-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/1480-8-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/4752-7-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/4752-18-0x0000000076A7A000-0x0000000076A7B000-memory.dmp

Filesize
4KB

Download
memory/4752-22-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/4752-23-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download