696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 16:03

Target

696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d.exe
Size

44KB
MD5

81f5c47c6bf8c15d6ea8b9c08da981d0
SHA1

7f2c48f60ba068dea41293792694814d880b1124
SHA256

696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d
SHA512

a90f8eeda30a6b8888ee339df02835f76cd108bbfc9e3c6882a58a250399db9445ada5a13f9b43b62483cf6abf724f4e00758dc605039be5335ac860e42334f9
SSDEEP

384:8bhEPF/q1L/SVB3WouYlBf3jd448Sa76uhAEfqMz+tUg:Khw9MLsxFBfZ44QfFf

Score

7^/10

Deletes itself 1 IoCs

pid	Process
948	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
896	696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\gdmhi32.dll	696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d.exe
File created	C:\Windows\SysWOW64\gdmhi32.dll	696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d.exe
File created	C:\Windows\SysWOW64\HookHelp.sys	696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d.exe
File opened for modification	C:\Windows\SysWOW64\gdmhi32.cfg	696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
896	696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 948	896	696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d.exe	28
PID 896 wrote to memory of 948	896	696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d.exe	28
PID 896 wrote to memory of 948	896	696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d.exe	28
PID 896 wrote to memory of 948	896	696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d.exe	28

C:\Users\Admin\AppData\Local\Temp\696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d.exe
"C:\Users\Admin\AppData\Local\Temp\696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\696b7ee9b9ff0242009fb1946e76547d3fe5e16368e97861b4b053fbe72b394d.exe"
  2⤵
  - Deletes itself
  PID:948

\Windows\SysWOW64\gdmhi32.dll

Filesize
17KB

MD5
70d3e55d354ddbd73354a82b3616e0d1

SHA1
ffa5659d5ded0c8a47ed8892e6d4fa46e0097a17

SHA256
ba42f48526dacbf5f50f7e7fa775e88005125f2314682a626f04a4507668982c

SHA512
b8474a0b502383edc21dfadb1be034691fb72ebcb1eaab2938c6f74bb1ca0840b5c7a59284c147a2e500ceeb978f15120bb084f4a64c4d3100f6a65ce2c5c00a

Download Submit
memory/896-55-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/896-56-0x0000000025000000-0x000000002501D000-memory.dmp

Filesize
116KB

Download
memory/896-58-0x0000000025000000-0x000000002501D000-memory.dmp

Filesize
116KB

Download