5b1d2aef92b03359fa09d8e93cb2eb5ac14ce5485f00f741b13a8395220299df

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 07:48

Target

2024-05-31_acac9ad34601095c592961ac89917849_hacktools_xiaoba.exe
Size

3.2MB
MD5

acac9ad34601095c592961ac89917849
SHA1

c35db2b7ddbaeb5efbf80e07799916cbe907bf23
SHA256

5b1d2aef92b03359fa09d8e93cb2eb5ac14ce5485f00f741b13a8395220299df
SHA512

b17368fecc3c0a1162953dfd84b4db691d30390886b7c3ac3fbd659f88ed3dad8b355bef9402aeabeec8993e3ed2c4f4d2302c4e2b7915ede4fd2fcf11f2e74d
SSDEEP

49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nb:DBIKRAGRe5K2UZn

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2912	f767bc5.exe

Loads dropped DLL 9 IoCs

pid	Process
2660	2024-05-31_acac9ad34601095c592961ac89917849_hacktools_xiaoba.exe
2660	2024-05-31_acac9ad34601095c592961ac89917849_hacktools_xiaoba.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2424	2912	WerFault.exe	28

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2660	2024-05-31_acac9ad34601095c592961ac89917849_hacktools_xiaoba.exe
2660	2024-05-31_acac9ad34601095c592961ac89917849_hacktools_xiaoba.exe
2912	f767bc5.exe
2912	f767bc5.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2912	2660	2024-05-31_acac9ad34601095c592961ac89917849_hacktools_xiaoba.exe	28
PID 2660 wrote to memory of 2912	2660	2024-05-31_acac9ad34601095c592961ac89917849_hacktools_xiaoba.exe	28
PID 2660 wrote to memory of 2912	2660	2024-05-31_acac9ad34601095c592961ac89917849_hacktools_xiaoba.exe	28
PID 2660 wrote to memory of 2912	2660	2024-05-31_acac9ad34601095c592961ac89917849_hacktools_xiaoba.exe	28
PID 2912 wrote to memory of 2424	2912	f767bc5.exe	30
PID 2912 wrote to memory of 2424	2912	f767bc5.exe	30
PID 2912 wrote to memory of 2424	2912	f767bc5.exe	30
PID 2912 wrote to memory of 2424	2912	f767bc5.exe	30

\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f767bc5.exe

Filesize
3.2MB

MD5
21f8dbe14cf38f6516d53be0b6e7a806

SHA1
05bc2a82e83d81d7a11a55384918bcc1202c0516

SHA256
7e7f555c6d9293005a70a7c27ed400b1513d1c29716b899f3bbe5e266a8285c4

SHA512
7fa909765d7c9f2c5c0d24873557bf9459012795adcf6a5c6422c37062f899f9de9487acd41ce01d6709370730125a39e4ee56aaf92694eabcf7d9b139230096

Download Submit
memory/2660-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/2660-1-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/2660-10-0x00000000026F0000-0x0000000002A95000-memory.dmp

Filesize
3.6MB

Download
memory/2660-13-0x00000000026F0000-0x0000000002A95000-memory.dmp

Filesize
3.6MB

Download
memory/2660-15-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/2912-12-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/2912-14-0x000000007652D000-0x000000007652E000-memory.dmp

Filesize
4KB

Download
memory/2912-44-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/2912-45-0x000000007652D000-0x000000007652E000-memory.dmp

Filesize
4KB

Download