7a0fc390552b21b671a9f87934ab161bab03e08cef9383c24e66300894f14ec5

Analysis

max time kernel
154s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 18:04

Target

VIP-CHAIR.exe
Size

5.6MB
MD5

1456d19f6e07ae3374e5c296f205a7e5
SHA1

21391320b8f27e7f8bbf9f25c0e97f58a82f5c28
SHA256

358e6a243ff184b5d0770e8c442a2a883257e925e66e2cb8c42e137d19059953
SHA512

0ccdbeeae6f05ebc8fae56b241e9ab9a090d5c3c771bcb9a6415c09f1217f02aa2e2465e4deb833c8a5d16139fb69e172d77c7c0dbf7ef25e217bc84a7319ba4
SSDEEP

98304:l5Po/g9kQoDuhk2M2uHSwfdnX/aqeAZnOIBggY5smGbirNFUM5p3KS:/o/EkJCduywkVAZnOIY5sJaAW3

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

VIP-CHAIR.exe

pid process

1804 VIP-CHAIR.exe
1804 VIP-CHAIR.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

VIP-CHAIR.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

VIP-CHAIR.execmd.exe

description	pid	process	target process
PID 1804 wrote to memory of 4104	1804	VIP-CHAIR.exe	cmd.exe
PID 1804 wrote to memory of 4104	1804	VIP-CHAIR.exe	cmd.exe
PID 4104 wrote to memory of 4624	4104	cmd.exe	certutil.exe
PID 4104 wrote to memory of 4624	4104	cmd.exe	certutil.exe
PID 4104 wrote to memory of 2540	4104	cmd.exe	find.exe
PID 4104 wrote to memory of 2540	4104	cmd.exe	find.exe
PID 4104 wrote to memory of 5112	4104	cmd.exe	find.exe
PID 4104 wrote to memory of 5112	4104	cmd.exe	find.exe
PID 1804 wrote to memory of 5072	1804	VIP-CHAIR.exe	cmd.exe
PID 1804 wrote to memory of 5072	1804	VIP-CHAIR.exe	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\VIP-CHAIR.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
2⤵
- Suspicious use of WriteProcessMemory
PID:4104

C:\Windows\system32\certutil.exe
certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\VIP-CHAIR.exe" MD5
3⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:3684

memory/1804-0-0x00007FF6AA189000-0x00007FF6AA526000-memory.dmp

Filesize
3.6MB

Download
memory/1804-1-0x00007FFEAA810000-0x00007FFEAA812000-memory.dmp

Filesize
8KB

Download
memory/1804-6-0x00007FF6AA0F0000-0x00007FF6AAAC2000-memory.dmp

Filesize
9.8MB

Download
memory/1804-3-0x00007FF6AA0F0000-0x00007FF6AAAC2000-memory.dmp

Filesize
9.8MB

Download
memory/1804-7-0x00007FF6AA189000-0x00007FF6AA526000-memory.dmp

Filesize
3.6MB

Download
memory/1804-8-0x00007FF6AA0F0000-0x00007FF6AAAC2000-memory.dmp

Filesize
9.8MB

Download