fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 08:20

Target

fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe
Size

388KB
MD5

fcd4387492a11919128ee95548267af3
SHA1

928ac32f2e41ba1fe43cb72c2100ccbdb03cc7fb
SHA256

fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70
SHA512

51d47c501f3b6ec1385aa59a21782cf78f006d6bcd35721e0891dc8abe59100c8ae37612ea332362426ba9e9059bf82ed2ecf80ebc8990141df51148053612dd
SSDEEP

6144:YFfVw/fi6O4knMMCOdF7xJTl3CjrlsCmRg/xj8tiLrsHV0H6gaD34Io:YhCa6OlPzJxSyCmah8tiLrsuafD34H

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Stub.exe.exe.txt	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe
File created	C:\Windows\SysWOW64\Tlb_writeprocessmemory.tlb	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe
File created	C:\Windows\SysWOW64\Zombie.tlb	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe
File created	C:\Windows\SysWOW64\mPelT.tlb	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1464 set thread context of 1116	1464	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1464	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1116	1464	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	27
PID 1464 wrote to memory of 1116	1464	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	27
PID 1464 wrote to memory of 1116	1464	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	27
PID 1464 wrote to memory of 1116	1464	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	27
PID 1464 wrote to memory of 1116	1464	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	27
PID 1464 wrote to memory of 1116	1464	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	27
PID 1464 wrote to memory of 1116	1464	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	27
PID 1464 wrote to memory of 1116	1464	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	27

C:\Users\Admin\AppData\Local\Temp\fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe
"C:\Users\Admin\AppData\Local\Temp\fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Local\Temp\fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe
  C:\Users\Admin\AppData\Local\Temp\fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe
  2⤵
  PID:1116

memory/1116-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1116-61-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1116-62-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1116-63-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1464-56-0x0000000000400000-0x000000000068E000-memory.dmp

Filesize
2.6MB

Download
memory/1464-60-0x0000000000400000-0x000000000068E000-memory.dmp

Filesize
2.6MB

Download