f65555e79ef0fb93485032d5b1d2ea8677da4de4e8f0afb10eca853d88d56d46

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 13:42

Target

f65555e79ef0fb93485032d5b1d2ea8677da4de4e8f0afb10eca853d88d56d46.exe
Size

2.3MB
MD5

970aff423689d1900aaafa10257453d4
SHA1

d3ad8f2a2174a19c1f1b3cbc9613d933728120da
SHA256

f65555e79ef0fb93485032d5b1d2ea8677da4de4e8f0afb10eca853d88d56d46
SHA512

3d4d60f3dc585a851d945a9da4ae2197784c09b9da02c7224502696fdd0eedfc42fce7b9232d412a0666681ef996aa81eb3e6958dd69e0e034dfacd782e6f7a9
SSDEEP

49152:0pFkGTkyxNmuLKZGatWVDMon0BdSeP4+lph9Ne:+km5LKZ7SDMiCdSn+lJNe

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
652	YShow3D.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
652	YShow3D.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 652	4688	f65555e79ef0fb93485032d5b1d2ea8677da4de4e8f0afb10eca853d88d56d46.exe	80
PID 4688 wrote to memory of 652	4688	f65555e79ef0fb93485032d5b1d2ea8677da4de4e8f0afb10eca853d88d56d46.exe	80
PID 4688 wrote to memory of 652	4688	f65555e79ef0fb93485032d5b1d2ea8677da4de4e8f0afb10eca853d88d56d46.exe	80

C:\Users\Admin\AppData\Local\Temp\f65555e79ef0fb93485032d5b1d2ea8677da4de4e8f0afb10eca853d88d56d46.exe
"C:\Users\Admin\AppData\Local\Temp\f65555e79ef0fb93485032d5b1d2ea8677da4de4e8f0afb10eca853d88d56d46.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Local\Temp\YShow3D.exe
  C:\Users\Admin\AppData\Local\Temp\\YShow3D.exe /i ÕÒ²»µ½Ö¸¶¨µÄ¼ÓÃÜËø£¡ /t ÌáÊ¾ÐÅÏ¢£º /k 16
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:652

C:\Users\Admin\AppData\Local\Temp\YShow3D.exe

Filesize
326KB

MD5
114c2e0034f2d2da14586526a76c0bc0

SHA1
5d9becc3a719bb168d878c4cf08881ea01a9a2f1

SHA256
8d7879d12460fb0af03ad5c720bf2e68cd02485a4cbf1e8d7bbf645d47da55e7

SHA512
b3563422d2e6c30864ce62e120b384b42ada0dbff1f0ebbb6115518d13a93717006094f2901af77f55f5d3742ae9571b9cc9d23ea8412ae07e6b012ce5ec64e3

Download Submit
memory/4688-0-0x0000000002480000-0x000000000258A000-memory.dmp

Filesize
1.0MB

Download