18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220

Analysis

max time kernel
19s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 23:44

Target

18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe
Size

88KB
MD5

8404ba5c28927c7c1cd383e8ea903500
SHA1

53aea8823f57f404bd0f8b87f06bf66b700db3c3
SHA256

18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220
SHA512

a923998c14781562cd525e18e2c977c57a1a48db448c6f9408a06c212c65a2e6f3366aecee1c07012a11d0c9b2dd5c25c086f85206a1a3e2d055017aafce6668
SSDEEP

1536:EnXKjomTVLT8bshTDlUxmDz8nrzJpiei4jXjx5qqU:qRaRYbshpz8XJpc4jXN5pU

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\userinit.exe	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe
File opened for modification	C:\Windows\SysWOW64\ntxeed.dll	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe
File opened for modification	C:\Windows\SysWOW64\amurpm.dll	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 1420	2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe
2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe
2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1420	2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	28
PID 2040 wrote to memory of 1420	2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	28
PID 2040 wrote to memory of 1420	2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	28
PID 2040 wrote to memory of 1420	2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	28
PID 2040 wrote to memory of 1420	2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	28
PID 2040 wrote to memory of 1420	2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	28
PID 2040 wrote to memory of 1420	2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	28
PID 2040 wrote to memory of 1420	2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	28
PID 2040 wrote to memory of 1420	2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	28
PID 2040 wrote to memory of 1420	2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	28
PID 2040 wrote to memory of 1420	2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	28
PID 2040 wrote to memory of 1420	2040	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	28

C:\Users\Admin\AppData\Local\Temp\18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe
"C:\Users\Admin\AppData\Local\Temp\18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe
  2⤵
  PID:1420

memory/1420-56-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1420-57-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1420-59-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1420-63-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download