fc115aa3b212d6d695b7a5c96536f7e72d433928c86193a8d5be85f4b08fe2a5

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:49

Target

611a7fa897f0b9484169c1d9e2b81de0.exe
Size

1.2MB
MD5

611a7fa897f0b9484169c1d9e2b81de0
SHA1

7f26fdc1ed6dc32992907a14503934c06762e274
SHA256

fc115aa3b212d6d695b7a5c96536f7e72d433928c86193a8d5be85f4b08fe2a5
SHA512

e4fccfe2f65b392091b35c8fba688e9d851b79b25d2912abe92ea2ec2c11b7595d533b3493b967d596e0d1d720db0c6ada71a71814b8ad4761046bb8acdb52c9
SSDEEP

24576:4zmMHxPxfyoJkOq+Uqh0Pg1xtojQyA/G0/k1eUl0+Hr8D/qTJeQMZsOPYnLnZU:4XHNxjkOeExtGuz2l0EsqTkQMZD8ZU

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ole32.dll	611a7fa897f0b9484169c1d9e2b81de0.exe
File opened for modification	C:\Windows\SysWOW64\advapi32.dll	611a7fa897f0b9484169c1d9e2b81de0.exe
File created	C:\Windows\SysWOW64\advapi32.dll	611a7fa897f0b9484169c1d9e2b81de0.exe
File opened for modification	C:\Windows\SysWOW64\ole32.dll	611a7fa897f0b9484169c1d9e2b81de0.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2964 set thread context of 2412	2964	611a7fa897f0b9484169c1d9e2b81de0.exe	15

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000320-0000-0000-C000-000000000046}	611a7fa897f0b9484169c1d9e2b81de0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	611a7fa897f0b9484169c1d9e2b81de0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	611a7fa897f0b9484169c1d9e2b81de0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2964	611a7fa897f0b9484169c1d9e2b81de0.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2412	2964	611a7fa897f0b9484169c1d9e2b81de0.exe	15
PID 2964 wrote to memory of 2412	2964	611a7fa897f0b9484169c1d9e2b81de0.exe	15
PID 2964 wrote to memory of 2412	2964	611a7fa897f0b9484169c1d9e2b81de0.exe	15
PID 2964 wrote to memory of 2412	2964	611a7fa897f0b9484169c1d9e2b81de0.exe	15
PID 2964 wrote to memory of 2412	2964	611a7fa897f0b9484169c1d9e2b81de0.exe	15
PID 2964 wrote to memory of 2412	2964	611a7fa897f0b9484169c1d9e2b81de0.exe	15
PID 2964 wrote to memory of 2412	2964	611a7fa897f0b9484169c1d9e2b81de0.exe	15
PID 2964 wrote to memory of 2412	2964	611a7fa897f0b9484169c1d9e2b81de0.exe	15

C:\Users\Admin\AppData\Local\Temp\611a7fa897f0b9484169c1d9e2b81de0.exe
"C:\Users\Admin\AppData\Local\Temp\611a7fa897f0b9484169c1d9e2b81de0.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\611a7fa897f0b9484169c1d9e2b81de0.exe
  C:\Users\Admin\AppData\Local\Temp\611a7fa897f0b9484169c1d9e2b81de0.exe
  2⤵
  PID:2412

memory/2412-8-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2412-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2412-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2412-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2412-15-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2412-14-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2964-1-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/2964-4-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/2964-11-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/2964-7-0x0000000002AD0000-0x0000000002C2F000-memory.dmp

Filesize
1.4MB

Download
memory/2964-2-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/2964-0-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download