7c8621cc3827c1ffbd39ebc8b24e430e2e6aa5bd7b148edc110be9b2914799dc

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/11/2022, 04:35

Target
fooler.exe
Size 2.9MB
Sample221112-e7nldsdf78
SHA256 7c8621cc3827c1ffbd39ebc8b24e430e2e6aa5bd7b148edc110be9b2914799dc
MD5 f73c7c5491733bbf72e84a3eec778875
SHA1 d8113a0f0151254616e08bd84683a76fefaeddec
SHA512 d4039cdc4c28cfd0fd8722ba9ca18913f8a7b2624aca86286c06c04208a7bf9476b0217ff4229161178b62fbec6cdef929e4d2878a6fa5cd4d4ef126820a9e0a
SSDEEP 49152:Dgb1V8K/33adBUE9cYsZx1MvxSJG0nnkU2ge2PWDH8Cc+zD:D383sUMsJGqkU2glWDZc+zD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1476 created 1340	1476	fooler.exe	20

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1476	fooler.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1992	1476	fooler.exe	28
PID 1476 wrote to memory of 1992	1476	fooler.exe	28
PID 1476 wrote to memory of 1992	1476	fooler.exe	28

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1340
- C:\Users\Admin\AppData\Local\Temp\fooler.exe
  "C:\Users\Admin\AppData\Local\Temp\fooler.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1476
- C:\Windows\System32\conhost.exe
  \??\C:Windows\system32\conhost.exe 0x4
  2⤵
  PID:1992

memory/1992-55-0x0000000001B60000-0x0000000001BE6000-memory.dmp

Download

memory/1992-56-0x000007FEFC311000-0x000007FEFC313000-memory.dmp

Download