Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/09/2024, 10:37
General
-
Target
TotalRecorder Pro v5.2 正式注册版/setup.exe
-
Size
352KB
-
MD5
1fee8031f794e6e1904c8e94e60a786d
-
SHA1
2f4c1126a47d97a8f142a57dfb199bdcde135e25
-
SHA256
16fca7cffc4084b8e97856c45163988d4e1a571bc5b3b6a36a5f6cc98f96c857
-
SHA512
938f31efcf3796f951ddf4c1e013f356eb149e16eda0a315f21872355284db2bc64068d405929c91d77fae8aa8034a5b8b3222205b97cbfc28f493c9f1adde25
-
SSDEEP
6144:aEw1JkyPfYTUHLVmvJXgnbK+UYYzm8kaA:ar1JkEjRgXgn4PmG
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TotalRecorder Pro v5.2 正式注册版\setup.exe"C:\Users\Admin\AppData\Local\Temp\TotalRecorder Pro v5.2 正式注册版\setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\pcaui.exe"C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {8427b8b3-1242-4be0-a7bd-744a994d5b44} -a "Total Recorder" -v "High Criteria inc." -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 1 -f 0 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\TotalRecorder Pro v5.2 正式注册版\setup.exe"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x504 0x4741⤵