e05d0054c7b7f93178065fc2002ee09a39475080d9e386d398623d81965622a8

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:10

Target

0ffabe170a6af62d45d473983cead3e6.exe
Size

2.8MB
MD5

0ffabe170a6af62d45d473983cead3e6
SHA1

d8a191d949de7fa1a18b42e146461a455bf13fcb
SHA256

e05d0054c7b7f93178065fc2002ee09a39475080d9e386d398623d81965622a8
SHA512

0d2df666ae8b141da769353d7a50bd2a94917281341fd6eaecfff9afb9fc1923db0dfdd02c0ef3ebc85bd7e609518d1ad90dc7ba9891d455e0861a16cebb31c8
SSDEEP

49152:/XLPvEOBj/kE1+xXd7XiG1Qm+kB28S7ugdZBUXkgd0iT6mDBerm:/TvbJEdTiG1QXkI8S7VZBUXp3T5DEr

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\ppp.exe	0ffabe170a6af62d45d473983cead3e6.exe
File created	C:\WINDOWS\CleanTemp.bat	0ffabe170a6af62d45d473983cead3e6.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	0ffabe170a6af62d45d473983cead3e6.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2096	0ffabe170a6af62d45d473983cead3e6.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2096	0ffabe170a6af62d45d473983cead3e6.exe
2096	0ffabe170a6af62d45d473983cead3e6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2156	2096	0ffabe170a6af62d45d473983cead3e6.exe	28
PID 2096 wrote to memory of 2156	2096	0ffabe170a6af62d45d473983cead3e6.exe	28
PID 2096 wrote to memory of 2156	2096	0ffabe170a6af62d45d473983cead3e6.exe	28
PID 2096 wrote to memory of 2156	2096	0ffabe170a6af62d45d473983cead3e6.exe	28

C:\Users\Admin\AppData\Local\Temp\0ffabe170a6af62d45d473983cead3e6.exe
"C:\Users\Admin\AppData\Local\Temp\0ffabe170a6af62d45d473983cead3e6.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\WINDOWS\SysWOW64\rasdial.exe
  "C:\WINDOWS\system32\rasdial.exe"
  2⤵
  PID:2156