2bc78b2cb385b002ee7cf3406e93c7ee336765022f9c3298637dc6496d8fc2fe

Analysis

max time kernel
124s
max time network
170s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 19:17

Target

츨12.16ɫ/츨12.16.exe
Size

2.4MB
MD5

ef3639349c9ff57b844796ba1b0913fc
SHA1

9619120ecb4474cc9754ba0e0c2870fb91008776
SHA256

6cf2e1ba22b4f1fbbf79139c76103a2f45ed712f0fc1908a2e73035ace561523
SHA512

2088bd15dcaa565950f260e59ec0bc0b79ef2ead0888e2c0a6ac423ed48ad4d29330eab83f88750e25d76bc9efa4412f21c45cda418e88a4e4b4958fadffc1ba
SSDEEP

49152:lhmKcQ8HScTgrMV+TN3ljQa4W1n1IbdHNUkW6uMbwWU+lxtU9rF+y89rF+Wj89rW:6KWHScUrtTBljQa4W1nqHzW6uMMWU+lv

Score

4^/10

Drops file in Windows directory 2 IoCs

Processes:

츨12.16.exe

description	ioc	process
File opened for modification	C:\Windows\logo.ico	츨12.16.exe
File opened for modification	C:\Windows\s07169400	츨12.16.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious behavior: RenamesItself 1 IoCs

Processes:

츨12.16.exe

pid process

1968 츨12.16.exe

pid	process
464

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

츨12.16.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

츨12.16.exe

description	pid	process	target process
PID 1968 wrote to memory of 960	1968	츨12.16.exe	cmd.exe
PID 1968 wrote to memory of 960	1968	츨12.16.exe	cmd.exe
PID 1968 wrote to memory of 960	1968	츨12.16.exe	cmd.exe
PID 1968 wrote to memory of 960	1968	츨12.16.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.exe
"C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\??????12.16?????????????\??????12.16?????.exe
  2⤵
  PID:960

memory/960-55-0x0000000000000000-mapping.dmp

Download
memory/1968-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download