c39cf8811864f0a039616cbc40cf05db95fe641aac4667f276aea24425bd88f0

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 05:00

Target

SuperOneClickv2.3.1/Drivers/i386/winusbcoinstaller2.dll
Size

831KB
MD5

8e7b9f81e8823fee2d82f7de3a44300b
SHA1

1633b3715014c90d1c552cd757ef5de33c161dee
SHA256

ebe3b7708dd974ee87efed3113028d266af87ca8dbae77c47c6f7612824d3d6c
SHA512

9ae37b2747589a0eb312473d895ef87404f4a395a27e15855826a75b4711ea934ca9a2b289df0abe0a8825dec2d5654a0b1603cf0b039fe25662359b730ce1a9
SSDEEP

12288:cZq3DFVAZjj5h7OqGDqY66s32+0SLqfhA50yWI7yBoM1oGloLwtxJYnPXrmQlT:cZwoP7MYG+pX501zBoC+wtxuPXrmQlT

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\setuperr.log	rundll32.exe
File opened for modification	C:\Windows\setupact.log	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2336	2356	rundll32.exe	1
PID 2356 wrote to memory of 2336	2356	rundll32.exe	1
PID 2356 wrote to memory of 2336	2356	rundll32.exe	1
PID 2356 wrote to memory of 2336	2356	rundll32.exe	1
PID 2356 wrote to memory of 2336	2356	rundll32.exe	1
PID 2356 wrote to memory of 2336	2356	rundll32.exe	1
PID 2356 wrote to memory of 2336	2356	rundll32.exe	1

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SuperOneClickv2.3.1\Drivers\i386\winusbcoinstaller2.dll,#1
1⤵
- Drops file in Windows directory
PID:2336

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SuperOneClickv2.3.1\Drivers\i386\winusbcoinstaller2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356