7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 23:05

Target

7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe
Size

29KB
MD5

ae6b03bdbe142dfc9e337415b4a0fed7
SHA1

50a1c6a4a11fed85dc1441320e52881b757c2b22
SHA256

7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663
SHA512

50aeb2acf43b3ed470ae39b7d8c5b68fd524489355a56e71e91d16905e8e41e2ddae35e3f20922e9fe5a757e9a6e10b1f6eef93c5736b4a3226fa4889005ba00
SSDEEP

384:v/4LNJY74JwOllSBQmrb0i5PrmqHIKpa54b5f0iws0wGXLs:v/qSamrxDmqoKM4Z0iwtwALs

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4644	2024061423.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4284	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe
4644	2024061423.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 4644	4284	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe	90
PID 4284 wrote to memory of 4644	4284	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe	90
PID 4284 wrote to memory of 4644	4284	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe	90
PID 4284 wrote to memory of 5068	4284	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe	91
PID 4284 wrote to memory of 5068	4284	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe	91
PID 4284 wrote to memory of 5068	4284	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe	91

C:\Users\Admin\AppData\Local\Temp\7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe
"C:\Users\Admin\AppData\Local\Temp\7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Users\Admin\AppData\Local\Temp\2024061423.exe
  C:\Users\Admin\AppData\Local\Temp\2024061423.exe down
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat
  2⤵
  PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:824

C:\Users\Admin\AppData\Local\Temp\2024061423.exe

Filesize
29KB

MD5
eb3ea22d4d30ac08d71137cb9c99bdc0

SHA1
7f17f6faca98534fc2e072f9e6c9428f71df14f9

SHA256
d0496d69d7f95c1ec9e51c6404d3a4206e528f90093a8d0f512c6bacf8891472

SHA512
9bc5466ea1247d3615387341734607933e72cde2208edad6f662263b40e14df4cd7d35163cf97f443ccc7cc65b3989105d87dc55cb51563edd45553f93086878

Download Submit
C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
267B

MD5
669a3ff7732aa82dcac8feb22e100747

SHA1
325a54698630a8e3801d7667658144412a034f4c

SHA256
78d4566ca95d3a0d89a2b619a6561f4b3bb25463c045d32a05fce9150dba9a67

SHA512
ca45d694ec59ca46cbf7532f54841edc5aae788cf297cf26ae3baf4c70c986b1417028615db817979097a1b011869374cd64e1ce669b131a7850771de5b97db4

Download Submit
memory/4644-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download