c61125f9c181923309986d409597f2ef8d72cf6cb2ce54c83b24e4c763e49947

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:32

Target

383d4a7a5d7c489a39f47d6736924adf.exe
Size

172KB
MD5

383d4a7a5d7c489a39f47d6736924adf
SHA1

df5f9ea91226dc872c52608d2188f040c75222d7
SHA256

c61125f9c181923309986d409597f2ef8d72cf6cb2ce54c83b24e4c763e49947
SHA512

25783c1c27a409efadbde17f8ebcab20dd2c4b6ce269f27a0825f4b02f72aed939025173f01a868bea6f423a4cf420a847cfcce5dd26ba09c28201c669cd3727
SSDEEP

3072:8khicw+BOgwZP3sQoYuf8pgcQWKg8vD3HGxK0roILGXq26xhxLGdV6wF/9snGa4m:F4P3sQFuf8pgcQWKg8vD3HGxK0roSGXe

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
1464	383d4a7a5d7c489a39f47d6736924adf.exe
1464	383d4a7a5d7c489a39f47d6736924adf.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\userfile.dll	383d4a7a5d7c489a39f47d6736924adf.exe
File opened for modification	C:\Windows\SysWOW64\userfile.dll	383d4a7a5d7c489a39f47d6736924adf.exe
File created	C:\Windows\SysWOW64\files.dll	383d4a7a5d7c489a39f47d6736924adf.exe
File opened for modification	C:\Windows\SysWOW64\files.dll	383d4a7a5d7c489a39f47d6736924adf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2536	1464	WerFault.exe	18

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1464	383d4a7a5d7c489a39f47d6736924adf.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1176	1464	383d4a7a5d7c489a39f47d6736924adf.exe	28
PID 1464 wrote to memory of 1176	1464	383d4a7a5d7c489a39f47d6736924adf.exe	28
PID 1464 wrote to memory of 1176	1464	383d4a7a5d7c489a39f47d6736924adf.exe	28
PID 1464 wrote to memory of 1176	1464	383d4a7a5d7c489a39f47d6736924adf.exe	28
PID 1464 wrote to memory of 2536	1464	383d4a7a5d7c489a39f47d6736924adf.exe	29
PID 1464 wrote to memory of 2536	1464	383d4a7a5d7c489a39f47d6736924adf.exe	29
PID 1464 wrote to memory of 2536	1464	383d4a7a5d7c489a39f47d6736924adf.exe	29
PID 1464 wrote to memory of 2536	1464	383d4a7a5d7c489a39f47d6736924adf.exe	29

C:\Users\Admin\AppData\Local\Temp\383d4a7a5d7c489a39f47d6736924adf.exe
"C:\Users\Admin\AppData\Local\Temp\383d4a7a5d7c489a39f47d6736924adf.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Local\Temp\383d4a7a5d7c489a39f47d6736924adf.exe
  2⤵
  PID:1176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 200
  2⤵
  - Program crash
  PID:2536

\Windows\SysWOW64\files.dll

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
\Windows\SysWOW64\userfile.dll

Filesize
813KB

MD5
5e0db2d8b2750543cd2ebb9ea8e6cdd3

SHA1
8b997b38e179cd03c0a2e87bddbc1ebca39a8630

SHA256
01eb95fa3943cf3c6b1a21e473a5c3cb9fcbce46913b15c96cac14e4f04075b4

SHA512
38a2064f7a740feb6dba46d57998140f16da7b9302bfe217a24d593220c2340f854645d05993aac6b7ecf819b5c09e062c5c81ba29f79d919ae518e6de071716

Download Submit