216e68edef5e4711b369f415d3e963cc4446eebcef22afe4b1aaaa4dc0d479db

Analysis

max time kernel
28s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 05:05

Target

216e68edef5e4711b369f415d3e963cc4446eebcef22afe4b1aaaa4dc0d479db.exe
Size

293KB
MD5

dc5bc8a4fa871c0532bf92abfda49d0f
SHA1

5496ce6b28b1c7f620bb250cfd701ed12e651f1c
SHA256

216e68edef5e4711b369f415d3e963cc4446eebcef22afe4b1aaaa4dc0d479db
SHA512

f7c1004637cb9387ea998bbe161f7eaa94ad109975c96c5ce3582cebf58af8e20e3c8c6488bc771cc19fe3600bf929b72755791eef2442cfccea5e5c68683ce5
SSDEEP

6144:5uHOcBsSE2El/UOPSe570Szp3irG1VVE+IA:gOcBsZuOB0Jut

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/968-54-0x0000000000400000-0x0000000000440000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	216e68edef5e4711b369f415d3e963cc4446eebcef22afe4b1aaaa4dc0d479db.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
968	216e68edef5e4711b369f415d3e963cc4446eebcef22afe4b1aaaa4dc0d479db.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1212	968	216e68edef5e4711b369f415d3e963cc4446eebcef22afe4b1aaaa4dc0d479db.exe	32
PID 968 wrote to memory of 1212	968	216e68edef5e4711b369f415d3e963cc4446eebcef22afe4b1aaaa4dc0d479db.exe	32
PID 968 wrote to memory of 1212	968	216e68edef5e4711b369f415d3e963cc4446eebcef22afe4b1aaaa4dc0d479db.exe	32
PID 968 wrote to memory of 1212	968	216e68edef5e4711b369f415d3e963cc4446eebcef22afe4b1aaaa4dc0d479db.exe	32

C:\Users\Admin\AppData\Local\Temp\216e68edef5e4711b369f415d3e963cc4446eebcef22afe4b1aaaa4dc0d479db.exe
"C:\Users\Admin\AppData\Local\Temp\216e68edef5e4711b369f415d3e963cc4446eebcef22afe4b1aaaa4dc0d479db.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\net.exe
  net.exe start schedule /y
  2⤵
  PID:1532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\Option.bat
  2⤵
  PID:1212

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:1404

C:\Windows\SysWOW64\Option.bat

Filesize
82B

MD5
3f7fbd2eb34892646e93fd5e6e343512

SHA1
265ac1061b54f62350fb7a5f57e566454d013a66

SHA256
e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7

SHA512
53d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140

Download Submit
memory/968-54-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1212-57-0x0000000000000000-mapping.dmp

Download
memory/1404-60-0x0000000000000000-mapping.dmp

Download
memory/1532-59-0x0000000000000000-mapping.dmp

Download