cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 14:12

Target

cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe
Size

50KB
MD5

640e035e648011f5c3b0cd5c808a402a
SHA1

35d0160865ef1fa2c656b8dc7e50bc853f85c3c0
SHA256

cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f
SHA512

69913e1a8e73de128c8e893f645b7216780757304657cde63a20416963b70dc48c0919a36f57df96513cbca0e4cef5e01524a03e2348380bdb67bbf2e14c1cec
SSDEEP

768:4PKrU5MxWV6GCmFvL6u8Udz90q9mpr5UTAJdfR7AoQaUMck83jN9ypn:8K5Vi9mJUNkpr5UAJfWajck83jNEpn

Score

7^/10

Deletes itself 1 IoCs

pid	Process
936	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\pmnnopm.dll	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe
File created	C:\Windows\SysWOW64\pmnnopm.dll	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 420	2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	3
PID 2016 wrote to memory of 972	2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	26
PID 2016 wrote to memory of 972	2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	26
PID 2016 wrote to memory of 972	2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	26
PID 2016 wrote to memory of 972	2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	26
PID 2016 wrote to memory of 972	2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	26
PID 2016 wrote to memory of 972	2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	26
PID 2016 wrote to memory of 972	2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	26
PID 2016 wrote to memory of 936	2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	27
PID 2016 wrote to memory of 936	2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	27
PID 2016 wrote to memory of 936	2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	27
PID 2016 wrote to memory of 936	2016	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	27

C:\Users\Admin\AppData\Local\Temp\cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe
"C:\Users\Admin\AppData\Local\Temp\cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe ›Èwvñ¡w¨ü,Activate
  2⤵
  PID:972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe"
  2⤵
  - Deletes itself
  PID:936

C:\Users\Admin\AppData\Local\Temp\removalfile.bat

Filesize
43B

MD5
9a7ef09167a6f4433681b94351509043

SHA1
259b1375ed8e84943ca1d42646bb416325c89e12

SHA256
d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7

SHA512
96b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df

Download Submit
\Windows\SysWOW64\pmnnopm.dll

Filesize
40KB

MD5
ee093325b1e04a3828a759fb4183b2bb

SHA1
9b0bc6674bbfe6943d265921a84a11dccd9114a5

SHA256
9a021120e7111053fe4d8400440c174cf1ff9fb9115659193cd38109fddfd4ab

SHA512
44b8b28cb930aa9f3c83666ddf81303a925ee672b35eca3131d542fc8d52e4112ec146d211e44c05abf1778e4211c02640d15415891d3010b24fd6a450a4c22f

Download Submit
memory/2016-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x0000000000400000-0x0000000000405600-memory.dmp

Filesize
21KB

Download
memory/2016-57-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2016-60-0x0000000000400000-0x0000000000405600-memory.dmp

Filesize
21KB

Download