b4736a0edf28985bd4f32322547b2b4910180ca79fd3ee548ce2f5849111b6ae

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 17:26

Target

农牧小黑/UpdateOnline.exe
Size

51KB
MD5

03d3d8dc528caf56ecc4f7e66dc4bf52
SHA1

925716a99829df1d87655aed5b678a940746f3a4
SHA256

43be7ef2cfa4e2d03b094ce8c9d9b39c94286bb8917548fbe7f9f6f442cd86b6
SHA512

ea3346c2e0a53cbf6ce902a8c4f85de6470283ca3febf827fb0bc698907a7b19e0e41038deecba14e784dcceebfdd038d62bfd0d860dc5fd22c417fc32689342
SSDEEP

768:zVJp7gvUSYwZLHSK9Hj6giPB0tZ5IJJYIbzuuo+PB0tZ5IJJYIbzuuoN:dgvHZLF9H+g/MJYEup7MJYEupN

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2524	UpdateOnline.exe
2524	UpdateOnline.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2416	2524	UpdateOnline.exe	31
PID 2524 wrote to memory of 2416	2524	UpdateOnline.exe	31
PID 2524 wrote to memory of 2416	2524	UpdateOnline.exe	31

C:\Users\Admin\AppData\Local\Temp\农牧小黑\UpdateOnline.exe
"C:\Users\Admin\AppData\Local\Temp\农牧小黑\UpdateOnline.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 480
  2⤵
  PID:2416

memory/2416-5-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2524-0-0x000007FEF614E000-0x000007FEF614F000-memory.dmp

Filesize
4KB

Download
memory/2524-1-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

Filesize
9.6MB

Download
memory/2524-2-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

Filesize
9.6MB

Download
memory/2524-3-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

Filesize
9.6MB

Download
memory/2524-4-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

Filesize
9.6MB

Download
memory/2524-6-0x000007FEF614E000-0x000007FEF614F000-memory.dmp

Filesize
4KB

Download
memory/2524-7-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

Filesize
9.6MB

Download