9651bac25ff2444aae79d2ff6c4d70b7601cfb6ffb707d3dc859d12d72c2fe26

Analysis

max time kernel
142s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 22:12

Target

fbe6b91027cb7e30049c445bb59eaee7.exe
Size

50KB
MD5

fbe6b91027cb7e30049c445bb59eaee7
SHA1

39d74d6582b2c5b53425f2db19b33e4084af3efc
SHA256

9651bac25ff2444aae79d2ff6c4d70b7601cfb6ffb707d3dc859d12d72c2fe26
SHA512

5e7d81eb1431c94f851fa7eadc6f84b07f6c2a748ea8958abea76c99085329674c1371d213a86100f0ea51f08461841abdb0cfbbf7600b1102a8ddab0a57438b
SSDEEP

768:lk36n/crFq0Ftq4QR02tvOP9YDLTpkiH+UGOnkcQ6lkxL2uaj26SkN:u3ucrFZA4q02tqOTam+P1r/aLSk

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1204	fbe6b91027cb7e30049c445bb59eaee7.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wvusrpm.dll	fbe6b91027cb7e30049c445bb59eaee7.exe
File created	C:\Windows\SysWOW64\wvusrpm.dll	fbe6b91027cb7e30049c445bb59eaee7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1204	fbe6b91027cb7e30049c445bb59eaee7.exe
1204	fbe6b91027cb7e30049c445bb59eaee7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	fbe6b91027cb7e30049c445bb59eaee7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1204	fbe6b91027cb7e30049c445bb59eaee7.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 612	1204	fbe6b91027cb7e30049c445bb59eaee7.exe	3
PID 1204 wrote to memory of 2356	1204	fbe6b91027cb7e30049c445bb59eaee7.exe	101
PID 1204 wrote to memory of 2356	1204	fbe6b91027cb7e30049c445bb59eaee7.exe	101
PID 1204 wrote to memory of 2356	1204	fbe6b91027cb7e30049c445bb59eaee7.exe	101
PID 1204 wrote to memory of 3324	1204	fbe6b91027cb7e30049c445bb59eaee7.exe	103
PID 1204 wrote to memory of 3324	1204	fbe6b91027cb7e30049c445bb59eaee7.exe	103
PID 1204 wrote to memory of 3324	1204	fbe6b91027cb7e30049c445bb59eaee7.exe	103

C:\Users\Admin\AppData\Local\Temp\fbe6b91027cb7e30049c445bb59eaee7.exe
"C:\Users\Admin\AppData\Local\Temp\fbe6b91027cb7e30049c445bb59eaee7.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe ,Activate
  2⤵
  PID:2356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\fbe6b91027cb7e30049c445bb59eaee7.exe"
  2⤵
  PID:3324

C:\Users\Admin\AppData\Local\Temp\removalfile.bat

Filesize
43B

MD5
9a7ef09167a6f4433681b94351509043

SHA1
259b1375ed8e84943ca1d42646bb416325c89e12

SHA256
d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7

SHA512
96b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df

Download Submit
C:\Windows\SysWOW64\wvusrpm.dll

Filesize
40KB

MD5
64f1beaf4bd64585802ba713e9982e7a

SHA1
27b0e2c0d377de979374123151bd3077d1f9a14a

SHA256
44a89b27d079cf020913dfc309afe25f9526e226b80eee6dceb0b30f07e852c9

SHA512
9fe08e3f679de244226ffed2eff7b3a239202ba3a71001813da91736441637407b0a050709108e2f8b4e4da4f99f970ba5072d8cd6826073e67b0a85722d4f4d

Download Submit
memory/1204-0-0x0000000000400000-0x0000000000405700-memory.dmp

Filesize
21KB

Download
memory/1204-4-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1204-9-0x0000000000400000-0x0000000000405700-memory.dmp

Filesize
21KB

Download