e4960d8ebe12da7bda6b4d94168c6ccb4680fae974e0f934f21e1ea8f7e82bba

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1add30552853926cdd3cf3929478952.exe
Size

55KB
MD5

a1add30552853926cdd3cf3929478952
SHA1

fbfcd983b96875998f385d319340e3beebed0d6e
SHA256

e4960d8ebe12da7bda6b4d94168c6ccb4680fae974e0f934f21e1ea8f7e82bba
SHA512

236710eba539c5645223edebfdae028c3088a0884932a4cd7e7c0d52deb41c0f174f9869abd1de5d90cc1ce5250e0b8b622c91a1e613930923ed0a95c2568608
SSDEEP

1536:VCtOrpkRo+3L9sjucUHkcIsU/wV4DB7cfLXZ71:hUo+3ZsTGkJwGDBQTXZR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 34 IoCs

pid	Process
1884	sfcp.exe
2648	sfcp.exe
2692	sfcp.exe
2468	sfcp.exe
2600	sfcp.exe
2484	sfcp.exe
3064	sfcp.exe
1360	sfcp.exe
2860	sfcp.exe
1864	sfcp.exe
764	sfcp.exe
1344	sfcp.exe
1504	sfcp.exe
1588	sfcp.exe
1768	sfcp.exe
2836	sfcp.exe
3016	sfcp.exe
2264	sfcp.exe
1152	sfcp.exe
1812	sfcp.exe
1348	sfcp.exe
1960	sfcp.exe
1424	sfcp.exe
2348	sfcp.exe
2848	sfcp.exe
1704	sfcp.exe
2168	sfcp.exe
2660	sfcp.exe
2588	sfcp.exe
2648	sfcp.exe
2676	sfcp.exe
2432	sfcp.exe
2016	sfcp.exe
880	sfcp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	a1add30552853926cdd3cf3929478952.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File created	C:\Windows\SysWOW64\SysIdt.dll	a1add30552853926cdd3cf3929478952.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	a1add30552853926cdd3cf3929478952.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\SysIdt.dll	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe
File opened for modification	C:\Windows\SysWOW64\sfcp.exe	sfcp.exe

Suspicious behavior: RenamesItself 34 IoCs

pid	Process
2372	a1add30552853926cdd3cf3929478952.exe
1884	sfcp.exe
2648	sfcp.exe
2692	sfcp.exe
2468	sfcp.exe
2600	sfcp.exe
2484	sfcp.exe
3064	sfcp.exe
1360	sfcp.exe
2860	sfcp.exe
1864	sfcp.exe
764	sfcp.exe
1344	sfcp.exe
1504	sfcp.exe
1588	sfcp.exe
1768	sfcp.exe
2836	sfcp.exe
3016	sfcp.exe
2264	sfcp.exe
1152	sfcp.exe
1812	sfcp.exe
1348	sfcp.exe
1960	sfcp.exe
1424	sfcp.exe
2348	sfcp.exe
2848	sfcp.exe
1704	sfcp.exe
2168	sfcp.exe
2660	sfcp.exe
2588	sfcp.exe
2648	sfcp.exe
2676	sfcp.exe
2432	sfcp.exe
2016	sfcp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1884	2372	a1add30552853926cdd3cf3929478952.exe	28
PID 2372 wrote to memory of 1884	2372	a1add30552853926cdd3cf3929478952.exe	28
PID 2372 wrote to memory of 1884	2372	a1add30552853926cdd3cf3929478952.exe	28
PID 2372 wrote to memory of 1884	2372	a1add30552853926cdd3cf3929478952.exe	28
PID 1884 wrote to memory of 2648	1884	sfcp.exe	29
PID 1884 wrote to memory of 2648	1884	sfcp.exe	29
PID 1884 wrote to memory of 2648	1884	sfcp.exe	29
PID 1884 wrote to memory of 2648	1884	sfcp.exe	29
PID 2648 wrote to memory of 2692	2648	sfcp.exe	30
PID 2648 wrote to memory of 2692	2648	sfcp.exe	30
PID 2648 wrote to memory of 2692	2648	sfcp.exe	30
PID 2648 wrote to memory of 2692	2648	sfcp.exe	30
PID 2692 wrote to memory of 2468	2692	sfcp.exe	31
PID 2692 wrote to memory of 2468	2692	sfcp.exe	31
PID 2692 wrote to memory of 2468	2692	sfcp.exe	31
PID 2692 wrote to memory of 2468	2692	sfcp.exe	31
PID 2468 wrote to memory of 2600	2468	sfcp.exe	32
PID 2468 wrote to memory of 2600	2468	sfcp.exe	32
PID 2468 wrote to memory of 2600	2468	sfcp.exe	32
PID 2468 wrote to memory of 2600	2468	sfcp.exe	32
PID 2600 wrote to memory of 2484	2600	sfcp.exe	33
PID 2600 wrote to memory of 2484	2600	sfcp.exe	33
PID 2600 wrote to memory of 2484	2600	sfcp.exe	33
PID 2600 wrote to memory of 2484	2600	sfcp.exe	33
PID 2484 wrote to memory of 3064	2484	sfcp.exe	34
PID 2484 wrote to memory of 3064	2484	sfcp.exe	34
PID 2484 wrote to memory of 3064	2484	sfcp.exe	34
PID 2484 wrote to memory of 3064	2484	sfcp.exe	34
PID 3064 wrote to memory of 1360	3064	sfcp.exe	35
PID 3064 wrote to memory of 1360	3064	sfcp.exe	35
PID 3064 wrote to memory of 1360	3064	sfcp.exe	35
PID 3064 wrote to memory of 1360	3064	sfcp.exe	35
PID 1360 wrote to memory of 2860	1360	sfcp.exe	36
PID 1360 wrote to memory of 2860	1360	sfcp.exe	36
PID 1360 wrote to memory of 2860	1360	sfcp.exe	36
PID 1360 wrote to memory of 2860	1360	sfcp.exe	36
PID 2860 wrote to memory of 1864	2860	sfcp.exe	39
PID 2860 wrote to memory of 1864	2860	sfcp.exe	39
PID 2860 wrote to memory of 1864	2860	sfcp.exe	39
PID 2860 wrote to memory of 1864	2860	sfcp.exe	39
PID 1864 wrote to memory of 764	1864	sfcp.exe	40
PID 1864 wrote to memory of 764	1864	sfcp.exe	40
PID 1864 wrote to memory of 764	1864	sfcp.exe	40
PID 1864 wrote to memory of 764	1864	sfcp.exe	40
PID 764 wrote to memory of 1344	764	sfcp.exe	41
PID 764 wrote to memory of 1344	764	sfcp.exe	41
PID 764 wrote to memory of 1344	764	sfcp.exe	41
PID 764 wrote to memory of 1344	764	sfcp.exe	41
PID 1344 wrote to memory of 1504	1344	sfcp.exe	42
PID 1344 wrote to memory of 1504	1344	sfcp.exe	42
PID 1344 wrote to memory of 1504	1344	sfcp.exe	42
PID 1344 wrote to memory of 1504	1344	sfcp.exe	42
PID 1504 wrote to memory of 1588	1504	sfcp.exe	43
PID 1504 wrote to memory of 1588	1504	sfcp.exe	43
PID 1504 wrote to memory of 1588	1504	sfcp.exe	43
PID 1504 wrote to memory of 1588	1504	sfcp.exe	43
PID 1588 wrote to memory of 1768	1588	sfcp.exe	44
PID 1588 wrote to memory of 1768	1588	sfcp.exe	44
PID 1588 wrote to memory of 1768	1588	sfcp.exe	44
PID 1588 wrote to memory of 1768	1588	sfcp.exe	44
PID 1768 wrote to memory of 2836	1768	sfcp.exe	45
PID 1768 wrote to memory of 2836	1768	sfcp.exe	45
PID 1768 wrote to memory of 2836	1768	sfcp.exe	45
PID 1768 wrote to memory of 2836	1768	sfcp.exe	45

C:\Users\Admin\AppData\Local\Temp\a1add30552853926cdd3cf3929478952.exe
"C:\Users\Admin\AppData\Local\Temp\a1add30552853926cdd3cf3929478952.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\sfcp.exe
  "C:\Windows\system32\sfcp.exe" C:\Users\Admin\AppData\Local\Temp\a1add30552853926cdd3cf3929478952.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\sfcp.exe
    "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious behavior: RenamesItself
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\SysWOW64\sfcp.exe
      "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: RenamesItself
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:2468
      - C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:764
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:1344
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:2836
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:3016
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:2264
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:1152
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:1812
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:1348
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:1960
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:1424
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:2348
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:2848
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:1704
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:2168
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:2660
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:2588
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:2648
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:2676
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:2432
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        
        PID:2016
        
        C:\Windows\SysWOW64\sfcp.exe
        
        "C:\Windows\system32\sfcp.exe" C:\Windows\SysWOW64\sfcp.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\SysIdt.dll

Filesize
88KB

MD5
aa60a7a114266185091cb3b4fdc620bd

SHA1
87801a5d4b83ab593be3115f9ab0fc9769f8ee4e

SHA256
30990014e670209f319f10a860438608609e407298d0ad259064c202f7e6e909

SHA512
88718ecfd8fd843368c569e0a789bd1737b029b43cf99a139005b79afb1eb0d8cac5dfc7bbcb74f22e2e478159c49bf4a12c5bdb43a30bac0dc79c3b13a55320

Download Submit
C:\Windows\SysWOW64\sfcp.exe

Filesize
55KB

MD5
a1add30552853926cdd3cf3929478952

SHA1
fbfcd983b96875998f385d319340e3beebed0d6e

SHA256
e4960d8ebe12da7bda6b4d94168c6ccb4680fae974e0f934f21e1ea8f7e82bba

SHA512
236710eba539c5645223edebfdae028c3088a0884932a4cd7e7c0d52deb41c0f174f9869abd1de5d90cc1ce5250e0b8b622c91a1e613930923ed0a95c2568608

Download Submit
memory/764-86-0x0000000000330000-0x000000000035F000-memory.dmp

Filesize
188KB

Download
memory/764-90-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/764-80-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/880-258-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1152-158-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1152-153-0x0000000000330000-0x000000000035F000-memory.dmp

Filesize
188KB

Download
memory/1152-155-0x0000000000330000-0x000000000035F000-memory.dmp

Filesize
188KB

Download
memory/1152-146-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1344-88-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1344-97-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1348-174-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1348-171-0x00000000002A0000-0x00000000002CF000-memory.dmp

Filesize
188KB

Download
memory/1348-164-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1360-65-0x00000000002A0000-0x00000000002CF000-memory.dmp

Filesize
188KB

Download
memory/1360-59-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1360-69-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1424-186-0x0000000000430000-0x000000000045F000-memory.dmp

Filesize
188KB

Download
memory/1424-180-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1424-189-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1504-105-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1504-101-0x00000000002A0000-0x00000000002CF000-memory.dmp

Filesize
188KB

Download
memory/1504-95-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1588-103-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1588-111-0x00000000002A0000-0x00000000002CF000-memory.dmp

Filesize
188KB

Download
memory/1588-109-0x00000000002A0000-0x00000000002CF000-memory.dmp

Filesize
188KB

Download
memory/1588-114-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1704-202-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1704-209-0x00000000003A0000-0x00000000003CF000-memory.dmp

Filesize
188KB

Download
memory/1704-212-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1768-120-0x0000000000350000-0x000000000037F000-memory.dmp

Filesize
188KB

Download
memory/1768-112-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1768-123-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1768-118-0x0000000000350000-0x000000000037F000-memory.dmp

Filesize
188KB

Download
memory/1812-156-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1812-163-0x00000000003B0000-0x00000000003DF000-memory.dmp

Filesize
188KB

Download
memory/1812-166-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1864-82-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1884-12-0x0000000000450000-0x000000000047F000-memory.dmp

Filesize
188KB

Download
memory/1884-17-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1884-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1884-14-0x0000000000450000-0x000000000047F000-memory.dmp

Filesize
188KB

Download
memory/1960-178-0x0000000000480000-0x00000000004AF000-memory.dmp

Filesize
188KB

Download
memory/1960-182-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1960-172-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2016-253-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2016-259-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2168-210-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2168-219-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2264-147-0x00000000003B0000-0x00000000003DF000-memory.dmp

Filesize
188KB

Download
memory/2264-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2264-149-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2264-144-0x00000000003B0000-0x00000000003DF000-memory.dmp

Filesize
188KB

Download
memory/2348-193-0x0000000001CC0000-0x0000000001CEF000-memory.dmp

Filesize
188KB

Download
memory/2348-197-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2372-4-0x00000000002A0000-0x00000000002CF000-memory.dmp

Filesize
188KB

Download
memory/2372-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2372-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2432-247-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2432-254-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2468-31-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2468-37-0x0000000000430000-0x000000000045F000-memory.dmp

Filesize
188KB

Download
memory/2468-41-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2484-46-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2484-54-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2588-224-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2588-234-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2588-231-0x0000000000320000-0x000000000034F000-memory.dmp

Filesize
188KB

Download
memory/2600-48-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2600-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2648-21-0x00000000003D0000-0x00000000003FF000-memory.dmp

Filesize
188KB

Download
memory/2648-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2648-232-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2648-25-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2648-241-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2660-217-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2660-226-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2676-249-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2676-245-0x00000000003A0000-0x00000000003CF000-memory.dmp

Filesize
188KB

Download
memory/2676-239-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2692-23-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2692-33-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2692-29-0x00000000002A0000-0x00000000002CF000-memory.dmp

Filesize
188KB

Download
memory/2836-131-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2836-127-0x0000000000460000-0x000000000048F000-memory.dmp

Filesize
188KB

Download
memory/2836-121-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2848-204-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2848-195-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2860-75-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2860-67-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3016-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3016-135-0x0000000000320000-0x000000000034F000-memory.dmp

Filesize
188KB

Download
memory/3016-137-0x0000000000320000-0x000000000034F000-memory.dmp

Filesize
188KB

Download
memory/3016-129-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3064-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads