9998034b4a25a37c86651d85306be7b1fe949be3df3ccbb0ede943bbef414f8a

Analysis

max time kernel
0s
max time network
3s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 10:55

Target
9998034b4a25a37c86651d85306be7b1fe949be3df3ccbb0ede943bbef414f8a.exe
Size 301KB
Sample241005-m1a1qa1amn
SHA256 9998034b4a25a37c86651d85306be7b1fe949be3df3ccbb0ede943bbef414f8a
MD5 27ed2ca1b852640d6cd2646672a90f74
SHA1 5869b882e35194e3f8536e1893055ba5eb2725b2
SHA512 9205238bd48e051d57fe66aba8dfc2367ec6c6c1e1c932e2af7353331820741c6d008547bb427bca19d19c3565765d0370af085523071f25ebf68e61f3088f2e
SSDEEP 6144:lCburfqKlylZXGSIqpMVsKnY4aF/5T9X:lC6hl3SIqpK5IB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	9998034b4a25a37c86651d85306be7b1fe949be3df3ccbb0ede943bbef414f8a.exe

C:\Users\Admin\AppData\Local\Temp\9998034b4a25a37c86651d85306be7b1fe949be3df3ccbb0ede943bbef414f8a.exe
"C:\Users\Admin\AppData\Local\Temp\9998034b4a25a37c86651d85306be7b1fe949be3df3ccbb0ede943bbef414f8a.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f "C:\Windows\System32\ntoskrnl.exe"
  2⤵
  PID:2064