a5597e1523b2af229f157b65d96b6e0075f42efefa965d4aa900bf80e0d3e9eb

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 08:08

Target

5abb8abd5030646239aba65d314375cc.exe
Size

184KB
MD5

5abb8abd5030646239aba65d314375cc
SHA1

0bbcafbd23ba475350799fbad301d4456fd15029
SHA256

a5597e1523b2af229f157b65d96b6e0075f42efefa965d4aa900bf80e0d3e9eb
SHA512

c9962b27c8d4d1a9664677403434738e0887cb5824703765744294a669ed797c52576e0ed0f8b8ee9491119a217d8a782634542d68d07ae5ec4cb55de85371bb
SSDEEP

3072:FKBYqKA1fjID6YxDrpuboYuooDwRiZhRI99FpWmB99:kBxpm6UcojZh6rN

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\svflooje.exe	5abb8abd5030646239aba65d314375cc.exe

Executes dropped EXE 1 IoCs

pid	Process
2300	svflooje.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\keys.ini	5abb8abd5030646239aba65d314375cc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2476	2300	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2476	2300	svflooje.exe	29
PID 2300 wrote to memory of 2476	2300	svflooje.exe	29
PID 2300 wrote to memory of 2476	2300	svflooje.exe	29
PID 2300 wrote to memory of 2476	2300	svflooje.exe	29

C:\Windows\SysWOW64\drivers\svflooje.exe
C:\Windows\SysWOW64\drivers\svflooje.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 200
  2⤵
  - Program crash
  PID:2476

C:\Windows\SysWOW64\drivers\svflooje.exe

Filesize
184KB

MD5
5abb8abd5030646239aba65d314375cc

SHA1
0bbcafbd23ba475350799fbad301d4456fd15029

SHA256
a5597e1523b2af229f157b65d96b6e0075f42efefa965d4aa900bf80e0d3e9eb

SHA512
c9962b27c8d4d1a9664677403434738e0887cb5824703765744294a669ed797c52576e0ed0f8b8ee9491119a217d8a782634542d68d07ae5ec4cb55de85371bb

Download Submit
memory/828-4-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/828-6-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download