7a5cd7d9d0ac982f09c8a93051fc48ab072fcc4b52237d1b91494363b9dad27e

Analysis

max time kernel
90s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
25/08/2024, 11:00

Target
vcxsrv.exe
Size 3.6MB
Sample240825-m4dwsasfln
SHA256 a00a750402f9940073e1b4be8cf260f368e1a23ecf6f637de3aa4d4b4cd4e213
MD5 10297f84807f79024874c61c0fbdc616
SHA1 61c617efd35ba10132449cc07de62c0aaedb50d3
SHA512 3cdc10538e645ae8c1f28b177ccfa4eb36506ff47984cc77a34667eebf654ecf6dc4647f0bc4925cf8d2f6da51174b3f77803f6df3922ffe34f7453dc0abe43b
SSDEEP 49152:2aE8tjZQl6saqAPgkymuGXzosh2arpyiDMvEeEKPRD7aOzuLI+oX9IhHow9+uD:+w1rt0YYzak9IhHowouD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of FindShellTrayWindow 6 IoCs

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3388	vcxsrv.exe
3388	vcxsrv.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 3484	3388	vcxsrv.exe	78
PID 3388 wrote to memory of 3484	3388	vcxsrv.exe	78
PID 3388 wrote to memory of 3980	3388	vcxsrv.exe	79
PID 3388 wrote to memory of 3980	3388	vcxsrv.exe	79

C:\Users\Admin\AppData\Local\Temp\vcxsrv.exe
"C:\Users\Admin\AppData\Local\Temp\vcxsrv.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Users\Admin\AppData\Local\Temp\xkbcomp.exe
  "C:\Users\Admin\AppData\Local\Temp\xkbcomp" -w 1 "-RC:\Users\Admin\AppData\Local\Temp\xkbdata" -xkm "C:\Users\Admin\AppData\Local\Temp\xkb_a02956" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\Admin\AppData\Local\Temp\server-0.xkm"
  2⤵
  PID:3484
- C:\Users\Admin\AppData\Local\Temp\xkbcomp.exe
  "C:\Users\Admin\AppData\Local\Temp\xkbcomp" -w 1 "-RC:\Users\Admin\AppData\Local\Temp\xkbdata" -xkm "C:\Users\Admin\AppData\Local\Temp\xkb_a02956" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\Admin\AppData\Local\Temp\server-0.xkm"
  2⤵
  PID:3980

server-0.xkm

Path C:\Users\Admin\AppData\Local\Temp\server-0.xkm
Size 11KB
SHA256 6f35e27783e77695a0b10b2fad9980d8d4929e4f01d313820550e36782b3d94d
MD5 fb57d1c3292c152eccd22494827bdd38
SHA1 a953bac00b66c3edb91276f11273d815a9093997
SHA512 02103937273ea7c3c74cb8ae2dd9b12e07e4908c3f2b34a7eeda4276216e8a447c9f6f5ea1e045f2d482137b2dd906bf97ea7b7365f2d6c993373035219ef196
SSDEEP 192:+aD29sY968QmwTVFfiaSLusAVcqLkjoZ85COCQVNJdDx0s2T:dD268YhFfnS69zmQ8+Ie
MD5 SHA1 SHA512 SSDEEP

Submit Download

server-0.xkm

Path C:\Users\Admin\AppData\Local\Temp\server-0.xkm
Size 11KB
SHA256 215ba1c65d720e1df3072e490e6aed1b0e4bbd0d03cf4d402fe7c4a6aaf1334b
MD5 3b4bc8671964e0494c9142363ec85f43
SHA1 4e273e983781bc82530b10fef8c8187d967477ba
SHA512 fcfb3395e01857d8f7dd2d9617168f8148bb9f6033e29801e7919e0223cc3a3ac568a34917d1ef14954b68d3a256f2f2757e41ec53ba6013cfdb7379b580857c
SSDEEP 192:aD29sY968QmwTVFfmaSLussVcqLkjoZV3eCQ1+JdDx0s2T:aD268YhFfLS6RzmQNMJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

xkb_a02956

Path C:\Users\Admin\AppData\Local\Temp\xkb_a02956
Size 311B
SHA256 46d3af7295ff52ea426d3a72cc25c2a55ede1dbc8d8c9a977abc92842acdb181
MD5 ae6099b85cf164242d1e272553bb5795
SHA1 3b7f4f2ca49e77899891dfc91df29d71f330e749
SHA512 bbba9b168e2a2da5db348cb5dbb0291097b85ef63345d5a298b952fd33989ff080fa4725454ded319263463fd0b74bbfcc3345bf14bde0479944ab2fd71a09de
MD5 SHA1 SHA512

Submit Download

xkb_a02956

Path C:\Users\Admin\AppData\Local\Temp\xkb_a02956
Size 343B
SHA256 5a0e759b25e97915fe7380d76866dfd692d218faa7e9c6b10377fbcb688e4e55
MD5 772dbf79a529ca1636dbf818bc2f1d2a
SHA1 4321a2e604a794a0f6f57570ae44fc2485868cac
SHA512 8800aed84f19f6fcc0acbcd08e6e9dee9d4b0ee344765369549187a3d5171559fbc234dcf5bbfac5ce27219b5b5b2e374e6b35c51c5cf3f87be2a5ba493efa43
MD5 SHA1 SHA512

Submit Download