7cc86dbfd063e576fa3bd6a56b25410cf6c2df243bfd7cd09fe3ea7cc3c60c8a

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 13:15

Target

WSLfilejo.exe
Size

855KB
MD5

a39fb0a630fa969169dcb86893977dde
SHA1

5c12be70e5c099d4c9db5b980c98ee70686bbbfb
SHA256

9080111dda29e1a7671f3db5d33f572637f8c8a3733c758e3f9a14e8c14156de
SHA512

1ecfc8da23a756b85661909425d6c35e8c69fca1a608214aa63f6c5df45bf52d919366e359cafabc878cf4356d0cb112f75fc1c326e00d65425676f72fe507d8
SSDEEP

12288:ARJ3QwI78m2RCzlVNRZYW5HJfN3uxWmQ9QRL1dF2Ahcsd57:aQh8m2RCzlVN51JfNexWmQ9CZDSu7

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	WSLfilejo.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2428	WSLfilejo.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 1704	2428	WSLfilejo.exe	16
PID 2428 wrote to memory of 1704	2428	WSLfilejo.exe	16
PID 2428 wrote to memory of 1704	2428	WSLfilejo.exe	16
PID 2428 wrote to memory of 1704	2428	WSLfilejo.exe	16
PID 1704 wrote to memory of 2664	1704	cmd.exe	19
PID 1704 wrote to memory of 2664	1704	cmd.exe	19
PID 1704 wrote to memory of 2664	1704	cmd.exe	19
PID 1704 wrote to memory of 2664	1704	cmd.exe	19
PID 2428 wrote to memory of 2388	2428	WSLfilejo.exe	25
PID 2428 wrote to memory of 2388	2428	WSLfilejo.exe	25
PID 2428 wrote to memory of 2388	2428	WSLfilejo.exe	25
PID 2428 wrote to memory of 2388	2428	WSLfilejo.exe	25
PID 2388 wrote to memory of 2760	2388	cmd.exe	23
PID 2388 wrote to memory of 2760	2388	cmd.exe	23
PID 2388 wrote to memory of 2760	2388	cmd.exe	23
PID 2388 wrote to memory of 2760	2388	cmd.exe	23

C:\Users\Admin\AppData\Local\Temp\WSLfilejo.exe
"C:\Users\Admin\AppData\Local\Temp\WSLfilejo.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C C:\Windows\system32\schtasks.exe /query /fo list
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\system32\schtasks.exe /query /fo list
    3⤵
    PID:2664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C C:\Windows\system32\schtasks.exe /query /fo list
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2388

C:\Windows\SysWOW64\schtasks.exe
C:\Windows\system32\schtasks.exe /query /fo list
1⤵
PID:2760

memory/2428-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2428-1-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download