effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 07:55

Target

effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe
Size

10KB
MD5

fbee3e39b2b39fa60a8be3f13d1f98a3
SHA1

1bf40c0c919ae15957ce7b49841317ac9e41a497
SHA256

effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae
SHA512

9fe80bd109d58a515e1d155bf11b8d84431f65f24724b6bcbf30123ab920b60be78c5d8948985590d484f5c53c7895e313eaa55c2b9e95ce639eb6a54dc187c6
SSDEEP

192:uPzu2qjomwqFWQS4NajcQXzTeb0+vlOpWAZ79z5D1Q54Iz05LS/eNu:8K2qjoqF8U+eA+9GWAZRYaI41S/eNu

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1168	system.exe

Deletes itself 1 IoCs

pid	Process
1988	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1884	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe
1884	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\system.exe	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe
File created	C:\Windows\SysWOW64\jiu.txt	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe
File created	C:\Windows\SysWOW64\system.exe	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1168	1884	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe	27
PID 1884 wrote to memory of 1168	1884	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe	27
PID 1884 wrote to memory of 1168	1884	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe	27
PID 1884 wrote to memory of 1168	1884	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe	27
PID 1884 wrote to memory of 1988	1884	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe	28
PID 1884 wrote to memory of 1988	1884	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe	28
PID 1884 wrote to memory of 1988	1884	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe	28
PID 1884 wrote to memory of 1988	1884	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe	28

C:\Users\Admin\AppData\Local\Temp\effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe
"C:\Users\Admin\AppData\Local\Temp\effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\system.exe
  C:\Windows\system32\system.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /q /a "C:\Users\Admin\AppData\Local\Temp\effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe"
  2⤵
  - Deletes itself
  PID:1988

C:\Windows\SysWOW64\system.exe

Filesize
10KB

MD5
fbee3e39b2b39fa60a8be3f13d1f98a3

SHA1
1bf40c0c919ae15957ce7b49841317ac9e41a497

SHA256
effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae

SHA512
9fe80bd109d58a515e1d155bf11b8d84431f65f24724b6bcbf30123ab920b60be78c5d8948985590d484f5c53c7895e313eaa55c2b9e95ce639eb6a54dc187c6

Download Submit
\Windows\SysWOW64\system.exe

Filesize
10KB

MD5
fbee3e39b2b39fa60a8be3f13d1f98a3

SHA1
1bf40c0c919ae15957ce7b49841317ac9e41a497

SHA256
effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae

SHA512
9fe80bd109d58a515e1d155bf11b8d84431f65f24724b6bcbf30123ab920b60be78c5d8948985590d484f5c53c7895e313eaa55c2b9e95ce639eb6a54dc187c6

Download Submit
\Windows\SysWOW64\system.exe

Filesize
10KB

MD5
fbee3e39b2b39fa60a8be3f13d1f98a3

SHA1
1bf40c0c919ae15957ce7b49841317ac9e41a497

SHA256
effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae

SHA512
9fe80bd109d58a515e1d155bf11b8d84431f65f24724b6bcbf30123ab920b60be78c5d8948985590d484f5c53c7895e313eaa55c2b9e95ce639eb6a54dc187c6

Download Submit
memory/1168-60-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1884-59-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download