dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 01:34

Target

dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9.exe
Size

85KB
MD5

34165491b1579d818a64a35d9358ad82
SHA1

3111461d29fa0e42f4c647126cf148245f3105df
SHA256

dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9
SHA512

d0b5fc38499af49d00473f916e4a18ce68d02e1e118ea1bf3556bf163e8b7337943e5ae7cda7951001418e704adf42dd67f014288020df45dae951a160a947fe
SSDEEP

1536:DFe87e7ngADyHvLNnkahFnToIfLKRtyxmz9:DFe87sDIvLNnkahtTBfWRtyxmz9

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Microsoft\at.exe	dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\at.exe	dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1760	dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1760	dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1672	1760	dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9.exe	28
PID 1760 wrote to memory of 1672	1760	dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9.exe	28
PID 1760 wrote to memory of 1672	1760	dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9.exe	28
PID 1760 wrote to memory of 1672	1760	dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9.exe	28
PID 1760 wrote to memory of 1672	1760	dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9.exe	28
PID 1760 wrote to memory of 1672	1760	dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9.exe	28
PID 1760 wrote to memory of 1672	1760	dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9.exe	28

C:\Users\Admin\AppData\Local\Temp\dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9.exe
"C:\Users\Admin\AppData\Local\Temp\dd4086fdfd4387fedf24bb63bd7588588f29ca2854cf1dd6d68224263e046cd9.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c md "C:\Windows\system32\Microsoft"
  2⤵
  PID:1672

memory/1760-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download