b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e

Analysis

max time kernel
26s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 20:14

Target

b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e.exe
Size

23KB
MD5

fe2e3d4284bdbd8bbc120d0c35f44860
SHA1

0e7b2a89bff16e05f23d0138414e5676b3034a88
SHA256

b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e
SHA512

d23dd7c207632902aada92ce3acbffc73a996c77fcc96c1a072b7bd53a9fd141c6dd7a4c5ac3119ff9deff4cece9843c0565d1a16b0cf4b94b327990a5a3fc30
SSDEEP

384:GtLLAeRbGwuqEMqP7gt5LxCoctnlc0TUtjvyuw8W8JoXZr4/qEfHcI6UNAa4zMDd:hQGpqEM87gt7Coc8WOjvyuVRopkzf7td

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2036	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1672	b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepion.sys	b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e.exe
File opened for modification	C:\Windows\SysWOW64\nauhgnem.cfg	b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e.exe
File opened for modification	C:\Windows\SysWOW64\nauhgnem.dll	b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e.exe
File created	C:\Windows\SysWOW64\nauhgnem.dll	b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1672	b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2036	1672	b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e.exe	27
PID 1672 wrote to memory of 2036	1672	b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e.exe	27
PID 1672 wrote to memory of 2036	1672	b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e.exe	27
PID 1672 wrote to memory of 2036	1672	b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e.exe	27

C:\Users\Admin\AppData\Local\Temp\b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e.exe
"C:\Users\Admin\AppData\Local\Temp\b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\b7f113289cf45c454153b30d14acf4c57cc1bc596d307288da21e2444774977e.exe"
  2⤵
  - Deletes itself
  PID:2036

\Windows\SysWOW64\nauhgnem.dll

Filesize
20KB

MD5
405bb93f3bbe507b00c7924512e65d67

SHA1
0b8620bda03cc65d77cdae69b9ceaea8ee48f22d

SHA256
8d7f97c052e46c8ccdf2fe560c254a927e65f99b6b124a9ba0c7b7fa7290f8be

SHA512
0257de66609c409f99138a876e8bbea37c76d18fcb30b56bf8f76be24afd2285ce393d2015d36bdff80a9a27d02732220b6756e2ccb5951f2b0c371a390f798b

Download Submit
memory/1672-55-0x0000000025000000-0x0000000025024000-memory.dmp

Filesize
144KB

Download
memory/2036-56-0x0000000000000000-mapping.dmp

Download