e198b8fc0631c05ef4fff3074ff4cf4d690b1c7af2f98131c9a0518a70a44d30

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 04:49

Target

e198b8fc0631c05ef4fff3074ff4cf4d690b1c7af2f98131c9a0518a70a44d30.exe
Size

36KB
MD5

4524ff6f589d9aa8dc20364b1a4a9ae0
SHA1

a5e4ec5a956f90f8777a3b9c6d869708322b1278
SHA256

e198b8fc0631c05ef4fff3074ff4cf4d690b1c7af2f98131c9a0518a70a44d30
SHA512

386f61ec96970fd1bea06f6905b574c2e8c615c6a4a93e3804e92f700e6709aa2dd01ac406c83e67e5425f2b07d8d80add17d8821befa204a8e21dcefae6f9dc
SSDEEP

384:qNcb2rfmHbXRRVuuniM1thLLp8ttXS/Bmkzr8AxhoSrgGUd+zsbCRw3TD30sXJIH:qNMHlxv1TLVEemDSrgt3bCRGx5+

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\EXPLORER.EXE	e198b8fc0631c05ef4fff3074ff4cf4d690b1c7af2f98131c9a0518a70a44d30.exe
File opened for modification	C:\Windows\SysWOW64\wsctf.exe	e198b8fc0631c05ef4fff3074ff4cf4d690b1c7af2f98131c9a0518a70a44d30.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
900	e198b8fc0631c05ef4fff3074ff4cf4d690b1c7af2f98131c9a0518a70a44d30.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 940	900	e198b8fc0631c05ef4fff3074ff4cf4d690b1c7af2f98131c9a0518a70a44d30.exe	27
PID 900 wrote to memory of 940	900	e198b8fc0631c05ef4fff3074ff4cf4d690b1c7af2f98131c9a0518a70a44d30.exe	27
PID 900 wrote to memory of 940	900	e198b8fc0631c05ef4fff3074ff4cf4d690b1c7af2f98131c9a0518a70a44d30.exe	27
PID 900 wrote to memory of 940	900	e198b8fc0631c05ef4fff3074ff4cf4d690b1c7af2f98131c9a0518a70a44d30.exe	27

C:\Users\Admin\AppData\Local\Temp\e198b8fc0631c05ef4fff3074ff4cf4d690b1c7af2f98131c9a0518a70a44d30.exe
"C:\Users\Admin\AppData\Local\Temp\e198b8fc0631c05ef4fff3074ff4cf4d690b1c7af2f98131c9a0518a70a44d30.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\EXPLORER.EXE
  C:\Windows\system32\EXPLORER.EXE
  2⤵
  PID:940

memory/940-57-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/940-58-0x0000000074AC1000-0x0000000074AC3000-memory.dmp

Filesize
8KB

Download