ef483723ac88d655dfc5f08537cbc7ca6bef3ca2c2f34fd1ade321156f4efe08

Analysis

max time kernel
1799s
max time network
1158s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 13:52

Target

ZRK 1.1 UC/ZRK 1.1.exe
Size

3.4MB
MD5

2ca19aa3d5216097c87698c0b569273d
SHA1

888e1e0eb175a4fef28d0d1285de3cb1605935da
SHA256

996a9b97adfd11ecb4d3c29fa4b1ca3d0c606b924c5affc9c2eb2846878cee37
SHA512

21285f484b73381e0b5598456238e585b73bfd37ef36a77c373a9f8696be4f360f42dbdcdb6d3509c332d3c9094e8fad93728d55c9c29451cdcd10506d9c3155
SSDEEP

49152:/u8OcIghRNkpSbKGvSHTNP9gt0H0XBWspHXWtKdfgzcv+IaiqE8MrCBpgTY840lG:WCk0bKWEP9jHOB7XWtsf2QA5pgTY8Dl

Score

1^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

ZRK 1.1.exe

pid	Process
3484	ZRK 1.1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ZRK 1.1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ZRK 1.1.exe

pid	Process
3484	ZRK 1.1.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

ZRK 1.1.exe

description	pid	Process	procid_target
PID 3484 wrote to memory of 548	3484	ZRK 1.1.exe	84
PID 3484 wrote to memory of 548	3484	ZRK 1.1.exe	84

C:\Users\Admin\AppData\Local\Temp\ZRK 1.1 UC\ZRK 1.1.exe
"C:\Users\Admin\AppData\Local\Temp\ZRK 1.1 UC\ZRK 1.1.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:548

memory/3484-0-0x00007FFE432C0000-0x00007FFE437B0000-memory.dmp

Filesize
4.9MB

Download
memory/3484-1-0x00007FFE42D70000-0x00007FFE432B1000-memory.dmp

Filesize
5.3MB

Download
memory/3484-2-0x00007FFE41E70000-0x00007FFE420D3000-memory.dmp

Filesize
2.4MB

Download
memory/3484-3-0x00007FFE41C00000-0x00007FFE41E65000-memory.dmp

Filesize
2.4MB

Download
memory/3484-4-0x0000025DD9A60000-0x0000025DD9A70000-memory.dmp

Filesize
64KB

Download