43aa1001a1a0bf74d37263f0c7115381b6532934bbcbc43316ce24c5bed0a1ed

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 18:56

Target

2024-07-10_29cd2c391afe7d26c23e12ce7f6979cd_hacktools_xiaoba.exe
Size

3.2MB
MD5

29cd2c391afe7d26c23e12ce7f6979cd
SHA1

46b03c8856830b934656dd20e49edad144bfceef
SHA256

43aa1001a1a0bf74d37263f0c7115381b6532934bbcbc43316ce24c5bed0a1ed
SHA512

a6b81581503fe39a2b17a51a23108325e91ee8af507c99fe9b55535f14b3c140dc586963888463b9ee298713247cd8a74e82e0ee10e0dd68bb1402312772a301
SSDEEP

49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nt:DBIKRAGRe5K2UZR

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2148	f771bea.exe

Loads dropped DLL 9 IoCs

pid	Process
1988	2024-07-10_29cd2c391afe7d26c23e12ce7f6979cd_hacktools_xiaoba.exe
1988	2024-07-10_29cd2c391afe7d26c23e12ce7f6979cd_hacktools_xiaoba.exe
2556	WerFault.exe
2556	WerFault.exe
2556	WerFault.exe
2556	WerFault.exe
2556	WerFault.exe
2556	WerFault.exe
2556	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2556	2148	WerFault.exe	30

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1988	2024-07-10_29cd2c391afe7d26c23e12ce7f6979cd_hacktools_xiaoba.exe
1988	2024-07-10_29cd2c391afe7d26c23e12ce7f6979cd_hacktools_xiaoba.exe
2148	f771bea.exe
2148	f771bea.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2148	1988	2024-07-10_29cd2c391afe7d26c23e12ce7f6979cd_hacktools_xiaoba.exe	30
PID 1988 wrote to memory of 2148	1988	2024-07-10_29cd2c391afe7d26c23e12ce7f6979cd_hacktools_xiaoba.exe	30
PID 1988 wrote to memory of 2148	1988	2024-07-10_29cd2c391afe7d26c23e12ce7f6979cd_hacktools_xiaoba.exe	30
PID 1988 wrote to memory of 2148	1988	2024-07-10_29cd2c391afe7d26c23e12ce7f6979cd_hacktools_xiaoba.exe	30
PID 2148 wrote to memory of 2556	2148	f771bea.exe	32
PID 2148 wrote to memory of 2556	2148	f771bea.exe	32
PID 2148 wrote to memory of 2556	2148	f771bea.exe	32
PID 2148 wrote to memory of 2556	2148	f771bea.exe	32

\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f771bea.exe

Filesize
3.2MB

MD5
5a293b38f3e8a2d897e2fbeac86f5662

SHA1
78819e6c57296f694dbf47d347936edfc1d5821b

SHA256
ce84733affcb51c5d00544fb1a5e59b0f839fddf9a19219eb168d063793f77e8

SHA512
ee9e7bdbdd29a733a6b9002fd4117fea29fd7afef99790ac9c25cc1cef285ea8b0d774af01be717361a9c1c56fe10fd920761729b82f475508c3ccc513f63fa8

Download Submit
memory/1988-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/1988-1-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/1988-9-0x0000000002AE0000-0x0000000002E85000-memory.dmp

Filesize
3.6MB

Download
memory/1988-12-0x0000000002AE0000-0x0000000002E85000-memory.dmp

Filesize
3.6MB

Download
memory/1988-34-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/2148-13-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/2148-15-0x0000000074F3D000-0x0000000074F3E000-memory.dmp

Filesize
4KB

Download
memory/2148-45-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/2148-46-0x0000000074F3D000-0x0000000074F3E000-memory.dmp

Filesize
4KB

Download