8188d8cf2a296f9dedb49e16851ffbf6818e8207f4c6afb3dc117ccab25b9536

Analysis

max time kernel
125s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:40

Target

1d4e7e5c14f4ad4be16561aa8cae2ba6.exe
Size

140KB
MD5

1d4e7e5c14f4ad4be16561aa8cae2ba6
SHA1

acbb3b33b0f28241a44b22fe48fbb0b4215a2727
SHA256

8188d8cf2a296f9dedb49e16851ffbf6818e8207f4c6afb3dc117ccab25b9536
SHA512

0d2486da628cc5448b14c4b42ecc7d53f8542376d87a0242f9e1d7cfaeab6c7c690493a3d0efff6209f1b67d0add0e170575e3bb778ce171fa1bd8070959a2e4
SSDEEP

3072:wipIBgjj5oE/Fb67z6XD1Q8UxjdLT+pjpKuj:xpIJE/BmzjdLTkKu

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
2796	obdmm32.exe
1980	obdmm32.exe

Loads dropped DLL 2 IoCs

pid	Process
2412	1d4e7e5c14f4ad4be16561aa8cae2ba6.exe
2412	1d4e7e5c14f4ad4be16561aa8cae2ba6.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\obdmm32.exe	1d4e7e5c14f4ad4be16561aa8cae2ba6.exe
File created	C:\Windows\SysWOW64\obdmm32.exe	1d4e7e5c14f4ad4be16561aa8cae2ba6.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1980	obdmm32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1980	obdmm32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2796	2412	1d4e7e5c14f4ad4be16561aa8cae2ba6.exe	27
PID 2412 wrote to memory of 2796	2412	1d4e7e5c14f4ad4be16561aa8cae2ba6.exe	27
PID 2412 wrote to memory of 2796	2412	1d4e7e5c14f4ad4be16561aa8cae2ba6.exe	27
PID 2412 wrote to memory of 2796	2412	1d4e7e5c14f4ad4be16561aa8cae2ba6.exe	27

C:\Users\Admin\AppData\Local\Temp\1d4e7e5c14f4ad4be16561aa8cae2ba6.exe
"C:\Users\Admin\AppData\Local\Temp\1d4e7e5c14f4ad4be16561aa8cae2ba6.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\obdmm32.exe
  C:\Windows\system32\obdmm32.exe -d "C:\Users\Admin\AppData\Local\Temp\1d4e7e5c14f4ad4be16561aa8cae2ba6.exe"
  2⤵
  - Executes dropped EXE
  PID:2796

C:\Windows\SysWOW64\obdmm32.exe

Filesize
140KB

MD5
1d4e7e5c14f4ad4be16561aa8cae2ba6

SHA1
acbb3b33b0f28241a44b22fe48fbb0b4215a2727

SHA256
8188d8cf2a296f9dedb49e16851ffbf6818e8207f4c6afb3dc117ccab25b9536

SHA512
0d2486da628cc5448b14c4b42ecc7d53f8542376d87a0242f9e1d7cfaeab6c7c690493a3d0efff6209f1b67d0add0e170575e3bb778ce171fa1bd8070959a2e4

Download Submit
\Windows\SysWOW64\obdmm32.exe

Filesize
140KB

MD5
1130752f272ec3bba992a39d5207ddb8

SHA1
56f3e751c4209ca0c5b53f83ef7c7d1d6afd395a

SHA256
1e068b6f6585756c5bf1254b5ead5244e1f1489758540616b4f32fe2a4caee65

SHA512
4b1327514e46671e018baa95f580096903a57fc173a3c03c031b4258f49e828818d34000c1874983bb2da1e85171521e437a27d54891eb5f427462798e366f99

Download Submit