3bb2f55ef7b2594a2abd2aab53b02c1055f7dbdcd4ab44c64922bb6143036488

Analysis

max time kernel
147s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 14:02

Target

23f63a3e08a87a939d9ee94bdf3acb9b.exe
Size

34KB
MD5

23f63a3e08a87a939d9ee94bdf3acb9b
SHA1

72196af933ace531c75ec821d573efa21a103558
SHA256

3bb2f55ef7b2594a2abd2aab53b02c1055f7dbdcd4ab44c64922bb6143036488
SHA512

5ad3fe4b35d1674a1297e30bc11d91143e952f23a823797869076beb5f102b03d05b89a7c70e3fc7ba2d676ea51196d83954104da25a0655ebfea55d1d5de431
SSDEEP

768:EX+JGEPufBq8/JhoQdvqunrJOmZ/XJNXXPxsM:EX+Jvu5qCJJdvqu17NXJVPn

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\skbskg.dll	23f63a3e08a87a939d9ee94bdf3acb9b.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	23f63a3e08a87a939d9ee94bdf3acb9b.exe
File opened for modification	C:\Windows\SysWOW64\mjenpp.dll	23f63a3e08a87a939d9ee94bdf3acb9b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1432 set thread context of 2696	1432	23f63a3e08a87a939d9ee94bdf3acb9b.exe	22

Program crash 1 IoCs

pid	pid_target	Process
424	2696	WerFault.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1432	23f63a3e08a87a939d9ee94bdf3acb9b.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2696	1432	23f63a3e08a87a939d9ee94bdf3acb9b.exe	22
PID 1432 wrote to memory of 2696	1432	23f63a3e08a87a939d9ee94bdf3acb9b.exe	22
PID 1432 wrote to memory of 2696	1432	23f63a3e08a87a939d9ee94bdf3acb9b.exe	22
PID 1432 wrote to memory of 2696	1432	23f63a3e08a87a939d9ee94bdf3acb9b.exe	22
PID 1432 wrote to memory of 2696	1432	23f63a3e08a87a939d9ee94bdf3acb9b.exe	22
PID 1432 wrote to memory of 2696	1432	23f63a3e08a87a939d9ee94bdf3acb9b.exe	22
PID 1432 wrote to memory of 2696	1432	23f63a3e08a87a939d9ee94bdf3acb9b.exe	22

C:\Users\Admin\AppData\Local\Temp\23f63a3e08a87a939d9ee94bdf3acb9b.exe
"C:\Users\Admin\AppData\Local\Temp\23f63a3e08a87a939d9ee94bdf3acb9b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe
  2⤵
  PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2696 -ip 2696
1⤵
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 12
1⤵
- Program crash
PID:424

memory/1432-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/1432-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1432-11-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2696-8-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download