85597c215a8a6a3c6093941998f05775811b40fecc31789291cbd4a96121524d

Analysis

max time kernel
183s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 06:32

Target

UNINST~1.exe
Size

32KB
MD5

8465192b9a8752ddd5829cb8d2ff17fe
SHA1

15a350ba63ee8880787b6fd3af6446046c796d0c
SHA256

fd730d73f5a2ca5c6fd0a6ae82153adf80f5b99d826004a419e69c0d15e91f68
SHA512

8eeaf57cc6c8dfdd172725fb9d2512e2a7b3c709834fd89cb0009625082477098a463a0fbcc45547a4be6c821e7a5813b4b73d210dc2defc61bb06d5c0a20c3c
SSDEEP

768:d4iFpuIy5DHyfxd2wXWGgfehbTuM0PBqKO7YqbMUPP4N1:qyuzsd2Sg2UFBNOBb/ID

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1324	UNINST~1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\iifddEWQ.dll	UNINST~1.exe
File opened for modification	C:\Windows\SysWOW64\iifddEWQ.dll	UNINST~1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1324	UNINST~1.exe
1324	UNINST~1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	UNINST~1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1324	UNINST~1.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 608	1324	UNINST~1.exe	3
PID 1324 wrote to memory of 4364	1324	UNINST~1.exe	81
PID 1324 wrote to memory of 4364	1324	UNINST~1.exe	81
PID 1324 wrote to memory of 4364	1324	UNINST~1.exe	81
PID 1324 wrote to memory of 460	1324	UNINST~1.exe	82
PID 1324 wrote to memory of 460	1324	UNINST~1.exe	82
PID 1324 wrote to memory of 460	1324	UNINST~1.exe	82

C:\Users\Admin\AppData\Local\Temp\UNINST~1.exe
"C:\Users\Admin\AppData\Local\Temp\UNINST~1.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe ,a
  2⤵
  PID:4364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\UNINST~1.exe"
  2⤵
  PID:460

C:\Users\Admin\AppData\Local\Temp\removalfile.bat

Filesize
43B

MD5
9a7ef09167a6f4433681b94351509043

SHA1
259b1375ed8e84943ca1d42646bb416325c89e12

SHA256
d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7

SHA512
96b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df

Download Submit
C:\Windows\SysWOW64\iifddEWQ.dll

Filesize
24KB

MD5
353ae103743b1eb5c05d0bc6f4a2a78a

SHA1
bf9235bc77490bcc85b72cbf2b37db7ac5abdfe9

SHA256
8c1dc12376501a3dc350076c0a41d108ce10cda44d1b068abdbad44534a0e77f

SHA512
d8d661d631d0f18dc1eac16538e2db1444bab8fe89f6cd42956ec3e7294e8f2a8d5de46623776ddc775cc70aa8e30f50362f16d7a08fbbbf68abb264d3fb7de1

Download Submit
memory/1324-132-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1324-134-0x0000000000530000-0x0000000000537000-memory.dmp

Filesize
28KB

Download
memory/1324-135-0x00000000004F0000-0x00000000004F5000-memory.dmp

Filesize
20KB

Download
memory/1324-136-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/1324-137-0x0000000000530000-0x0000000000537000-memory.dmp

Filesize
28KB

Download
memory/1324-138-0x00000000004F0000-0x00000000004F5000-memory.dmp

Filesize
20KB

Download