9b219398d2c742c11d9edab9a544bc292d6e6d7bdf0b5685e3e1d4f8369f16c8

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:39

Target

f6135dc34bdf2acfbd31b8ef40f1f582.exe
Size

184KB
MD5

f6135dc34bdf2acfbd31b8ef40f1f582
SHA1

34fd0b568917abd84690e9444268ef9b8b97c21d
SHA256

9b219398d2c742c11d9edab9a544bc292d6e6d7bdf0b5685e3e1d4f8369f16c8
SHA512

efac4c0066be929f6474de87f67654a248f9c25a4f27644a18556e409590d3a0a70b1c68eb158461e743e7de243322fd4e2b6a2f2a0af7fa842b94da34c38005
SSDEEP

3072:XynqoLBfwT6XqiBdZKxqzHCBYhRNf2IwcrNPQP5S7lSdppuT:Xyqota6XLdMxqzr3FZ7lSdp8

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
3064	Unicorn-51.exe
2796	Unicorn-.exe

Loads dropped DLL 16 IoCs

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2844	1576	WerFault.exe	1
2640	3064	WerFault.exe	28
2440	2796	WerFault.exe	30

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 3064	1576	f6135dc34bdf2acfbd31b8ef40f1f582.exe	28
PID 1576 wrote to memory of 3064	1576	f6135dc34bdf2acfbd31b8ef40f1f582.exe	28
PID 1576 wrote to memory of 3064	1576	f6135dc34bdf2acfbd31b8ef40f1f582.exe	28
PID 1576 wrote to memory of 3064	1576	f6135dc34bdf2acfbd31b8ef40f1f582.exe	28
PID 1576 wrote to memory of 2844	1576	f6135dc34bdf2acfbd31b8ef40f1f582.exe	29
PID 1576 wrote to memory of 2844	1576	f6135dc34bdf2acfbd31b8ef40f1f582.exe	29
PID 1576 wrote to memory of 2844	1576	f6135dc34bdf2acfbd31b8ef40f1f582.exe	29
PID 1576 wrote to memory of 2844	1576	f6135dc34bdf2acfbd31b8ef40f1f582.exe	29
PID 3064 wrote to memory of 2796	3064	Unicorn-51.exe	30
PID 3064 wrote to memory of 2796	3064	Unicorn-51.exe	30
PID 3064 wrote to memory of 2796	3064	Unicorn-51.exe	30
PID 3064 wrote to memory of 2796	3064	Unicorn-51.exe	30
PID 3064 wrote to memory of 2640	3064	Unicorn-51.exe	31
PID 3064 wrote to memory of 2640	3064	Unicorn-51.exe	31
PID 3064 wrote to memory of 2640	3064	Unicorn-51.exe	31
PID 3064 wrote to memory of 2640	3064	Unicorn-51.exe	31
PID 2796 wrote to memory of 2440	2796	Unicorn-.exe	32
PID 2796 wrote to memory of 2440	2796	Unicorn-.exe	32
PID 2796 wrote to memory of 2440	2796	Unicorn-.exe	32
PID 2796 wrote to memory of 2440	2796	Unicorn-.exe	32

C:\Users\Admin\AppData\Local\Temp\f6135dc34bdf2acfbd31b8ef40f1f582.exe
"C:\Users\Admin\AppData\Local\Temp\f6135dc34bdf2acfbd31b8ef40f1f582.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:2440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 236
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 236
  2⤵
  - Program crash
  PID:2844

\Users\Admin\AppData\Local\Temp\Unicorn-.exe

Filesize
8KB

MD5
021d9aee701f429bc075e3d35999ad09

SHA1
148d6304ff7f392da5578e7ae96d2795447b42dd

SHA256
3883035376fef4b5ec780a0e17111d327404439344e446359955478b991e1a31

SHA512
a5736a4400ae21e75c30cb3de41027f2e5175f94c546ed2208d4ca1e606665e72dd7e29e57fb65ee7e025404659bcee4536b3f650de1aa7dc0f4b4b5eea49fad

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-.exe

Filesize
184KB

MD5
685d52e128b27ea1228bbd44b301737f

SHA1
77b1dd355ffe457a548ccc1dfc3ecd717c66787a

SHA256
6a62f72f1a3c4aa6d9cfcdd82539660b451aa0fed908bba1aa2c98799f045ffd

SHA512
830efca0df268d615339d03d24b03efcba0e984214af78f1413092ea8d03f0c147e082b8d850c9a94d234892fd383d59d920e43c953757dc9f99866914e3d233

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51.exe

Filesize
184KB

MD5
d4ffb9f95623fd59bf9fdb6fd908d917

SHA1
2ae69ebbc03d3a839424ec314689215d61fb37fb

SHA256
760d468b9c04b2083ec348671186ec21883f9c5ae25fc1db4d4945d34ddfa489

SHA512
bee33df7a7866d109db50fb3c20e3e9ad0e4fd236844c0191a64c692a5a8bb34a05f7c033460f9bbdd4705208c4cd749723417b94aceaf31489a74216a0a1b78

Download Submit