afe33a2461331c3bdcf2dd06d1399aca5420d812a68adc092d269e7dfc9148ef

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 17:37

Target

astro injector.exe
Size

26KB
MD5

45988c9de2a6bf18a42638d33a57fac9
SHA1

effbbc98b7bec2df40faeb8bab5428fb20624293
SHA256

708095f325623bf03f0fad5f3372be8766fd89e9dffdd0f2cba173e0bfa970dc
SHA512

a4d461f40455c036f69b7a5212d1c757d2f20fd91515bd17a4415ef3c16ebc9be334ac4f5f74d3ad320ae55404a7d6bac239ce3f4ceebd7dc8c0101e8219e54e
SSDEEP

384:W4BpWH9PsHqrD/zTjYfJ53rri0sNn4mPmCFW/ae1a/pEX+QIZkCtyazNKcIL0S06:zvbAD/zXuZMn4ofFW/hEqaZKcI

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1020	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 2912	1468	astro injector.exe	83
PID 1468 wrote to memory of 2912	1468	astro injector.exe	83

C:\Users\Admin\AppData\Local\Temp\astro injector.exe
"C:\Users\Admin\AppData\Local\Temp\astro injector.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start steam://rungameid/2524890
  2⤵
  - Modifies registry class
  PID:2912

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1020