0a41ca962239a22f41d88370c02fc117d98f0d7cd333d8272a9e258cc4b7327a

Analysis

max time kernel
156s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:27

Target
1881aa92cece59c3cdc606a28e0f5b46.exe
Size 7KB
Sample231230-pm2mmaagg8
SHA256 0a41ca962239a22f41d88370c02fc117d98f0d7cd333d8272a9e258cc4b7327a
MD5 1881aa92cece59c3cdc606a28e0f5b46
SHA1 35951a487fb2696a76fdc71ab40459a6ec9ef2fb
SHA512 63b27c169cdc7116bdd7dc049f326eb2b88755bb3a06af62daaad99d5697fffdbd7e54b78b7b96250190164992a1d5235bd66b300116931c3db5527f8a58cd12
SSDEEP 192:MYRnJcVcjcDcSeeWhQ2P3Sjf0201zF2piDPbpQSzECXap:MuWVc4QSee/2vSjfT01zF2piDDRY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3832	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
3832	rundll32.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sys07002.sys	rundll32.exe
File created	C:\Windows\SysWOW64\gdipro.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\gdipro.dll	rundll32.exe
File created	C:\Windows\SysWOW64\srpcss.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\srpcss.dll	rundll32.exe
File created	C:\Windows\SysWOW64\sys07002.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sys07002.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3832	rundll32.exe
3832	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3832	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 3832	3180	1881aa92cece59c3cdc606a28e0f5b46.exe	87
PID 3180 wrote to memory of 3832	3180	1881aa92cece59c3cdc606a28e0f5b46.exe	87
PID 3180 wrote to memory of 3832	3180	1881aa92cece59c3cdc606a28e0f5b46.exe	87

C:\Users\Admin\AppData\Local\Temp\1881aa92cece59c3cdc606a28e0f5b46.exe
"C:\Users\Admin\AppData\Local\Temp\1881aa92cece59c3cdc606a28e0f5b46.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 C:\Users\Admin\AppData\Local\Temp\~e57b97c.tmp INS C:\Users\Admin\AppData\Local\Temp\1881aa92cece59c3cdc606a28e0f5b46.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3832

~e57b97c.tmp

Path C:\Users\Admin\AppData\Local\Temp\~e57b97c.tmp
Size 25KB
SHA256 1660178e47b76ea584f387f9c82bedb4e049616452ccfad291bce4da1804767d
MD5 5dfdd5e48502ab22e3cd7c1922c2e286
SHA1 c27bc9a4269adb96b4ac04ab6ef9e2be05c34ea1
SHA512 ea2e806fd44b530b632c3ca97ec9b785171caa05328ba07c317e227a3fc15b72d4437ef2e17020789fb6acda5fe134d0d14a1d1ede8a9d55f066d671c59ec0b8
SSDEEP 192:qdZn4EwVYD7ORz803ivZQGFa6sqw4im3R+SJR6+++dfMaHbd3rbn88inzjeQwPt9:qdZ4XKqRavZQGUOi9+lyCblbOqJtnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3832-3-0x0000000010000000-0x000000001001A000-memory.dmp

Download

memory/3832-11-0x0000000010000000-0x000000001001A000-memory.dmp

Download