1ab7b5aa280179b9f9550489c61512cbfd23219d31bbcbc9955340573323fd2e

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 05:07

Target

SS Tool [Extract]/Applications/ProcessHacker.exe
Size

2.2MB
MD5

54daad58cce5003bee58b28a4f465f49
SHA1

162b08b0b11827cc024e6b2eed5887ec86339baa
SHA256

28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063
SHA512

8330de722c8800ff64c6b9ea16a4ff7416915cd883e128650c47e5cb446dd3aaa2a9ba5c4ecda781d243be7fb437b054bbcf942ea714479e6cc3cef932390829
SSDEEP

49152:l9hfV/U5NkLXXzGZjt6kFTCVP6hWE0wvmk/eE+FrAl+NGsOSE6IX8pq:Dh9/ULkjKxtTGP6VZd2rAcvOSE6Nq

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

ProcessHacker.tmp

pid process

2536 ProcessHacker.tmp

pid	process
2536	ProcessHacker.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ProcessHacker.exe

description	pid	process	target process
PID 3392 wrote to memory of 2536	3392	ProcessHacker.exe	ProcessHacker.tmp
PID 3392 wrote to memory of 2536	3392	ProcessHacker.exe	ProcessHacker.tmp
PID 3392 wrote to memory of 2536	3392	ProcessHacker.exe	ProcessHacker.tmp

C:\Users\Admin\AppData\Local\Temp\SS Tool [Extract]\Applications\ProcessHacker.exe
"C:\Users\Admin\AppData\Local\Temp\SS Tool [Extract]\Applications\ProcessHacker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Users\Admin\AppData\Local\Temp\is-Q8DF1.tmp\ProcessHacker.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-Q8DF1.tmp\ProcessHacker.tmp" /SL5="$601CA,1874675,150016,C:\Users\Admin\AppData\Local\Temp\SS Tool [Extract]\Applications\ProcessHacker.exe"
  2⤵
  - Executes dropped EXE
  PID:2536

C:\Users\Admin\AppData\Local\Temp\is-Q8DF1.tmp\ProcessHacker.tmp

Filesize
785KB

MD5
1c96ed29e0136825e06f037bf10b2419

SHA1
b74a55279474253639bebf9c92f10f947145ff30

SHA256
b10cf8cdf541ca0dd6df79e66fb4b0854dcac717aba034ba0c4961bff92fd021

SHA512
0e74854d9de4e3944b2cff9b5de7eb19fdec1fee6c9576cae6cd81741adf84eac421cb743b1df30183f645ffe849357b6a85b5be8d7f6e2efe289bbe4573e177

Download Submit
memory/2536-6-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2536-12-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/3392-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3392-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/3392-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download