7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042

Analysis

max time kernel
90s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 09:26

Target

7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe
Size

40KB
MD5

ec7cb550ea81fb37cb32b554447c324a
SHA1

940143ee05501a3081a34456f7e59589d65ba9d4
SHA256

7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042
SHA512

c218f6079e54bc74cb60c3889adf3616d8a8433ffe0944a372f4a304ba4cf9bdb05218412439d894875d338757193c71bc7590d056305c97a4a493c57963f670
SSDEEP

768:r7+kabfs3o2LfEV0mF82DmOVkFP6Gw7fx55QOssBUaDh:2Ng39LfECRSVkFP6HJ55nDh

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4604	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\vtUnmLbX.dll	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe
File created	C:\Windows\SysWOW64\vtUnmLbX.dll	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4604	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe
4604	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4604	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4604	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 604	4604	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	4
PID 4604 wrote to memory of 176	4604	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	86
PID 4604 wrote to memory of 176	4604	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	86
PID 4604 wrote to memory of 176	4604	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	86
PID 4604 wrote to memory of 4840	4604	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	87
PID 4604 wrote to memory of 4840	4604	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	87
PID 4604 wrote to memory of 4840	4604	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	87

C:\Users\Admin\AppData\Local\Temp\7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe
"C:\Users\Admin\AppData\Local\Temp\7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe ,a
  2⤵
  PID:176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe"
  2⤵
  PID:4840

C:\Users\Admin\AppData\Local\Temp\removalfile.bat

Filesize
43B

MD5
9a7ef09167a6f4433681b94351509043

SHA1
259b1375ed8e84943ca1d42646bb416325c89e12

SHA256
d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7

SHA512
96b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df

Download Submit
C:\Windows\SysWOW64\vtUnmLbX.dll

Filesize
29KB

MD5
92ee37a8048ea4a1f5e55385d7ed257a

SHA1
07ee3f282448b560371ead6f4989ba668168ea2a

SHA256
e715060b64071d2371ccd4b3450555fd0801c32381a8ca463633c2d85883b062

SHA512
d09600ef62433f2189d6e84e6c056c5a88b4c63ce47c410a9ce92daf73947a35ef387b8cb9da99ee86412a1405703abf78b922271adef4163672e5140b7157df

Download Submit
memory/4604-132-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4604-134-0x00000000005C0000-0x00000000005C4000-memory.dmp

Filesize
16KB

Download
memory/4604-133-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4604-136-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4604-137-0x00000000024F0000-0x00000000024F4000-memory.dmp

Filesize
16KB

Download
memory/4604-138-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4604-139-0x00000000024F0000-0x00000000024F4000-memory.dmp

Filesize
16KB

Download