5bea020d1df8b313fe0c700cc5c981a5adb7bb8b1e540e2e4275b74e79773d41

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:28

Target

SecuriteInfo.com.Adware.Presenoker.32634.30496.exe
Size

1.2MB
MD5

9d4b1f7d38a95f469569aba59469820f
SHA1

b9c2634d2c6332b9336e94625b37c3e1a26ea2bb
SHA256

5bea020d1df8b313fe0c700cc5c981a5adb7bb8b1e540e2e4275b74e79773d41
SHA512

91f0bfc67b714fee355fa546630c75223d077f55e9f8eef9e2c2d8b45c3d91e8e6768f8d613ae2e18a46d7a6ce2cd331f26e87ad3d1c5de21c2e0830c0ab4bb4
SSDEEP

24576:fYDGpx5RWaAYHTrxmUmaS9T2UGJ/tWi7ImpKn0yQ+280Ht/a38hUs1i:fYDGpx5cwHTVmUmbT2U8Ai7I3n92DwUw

Score

1^/10

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

SecuriteInfo.com.Adware.Presenoker.32634.30496.exe

pid	process
4432	SecuriteInfo.com.Adware.Presenoker.32634.30496.exe
4432	SecuriteInfo.com.Adware.Presenoker.32634.30496.exe
4432	SecuriteInfo.com.Adware.Presenoker.32634.30496.exe
4432	SecuriteInfo.com.Adware.Presenoker.32634.30496.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.Presenoker.32634.30496.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.Presenoker.32634.30496.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4432

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c0 0x2fc
1⤵
PID:1032