723e114f727dae196785e4912453ff0116f93a829160bd7995c5671a5640105a

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 17:01

Target

d6a62b97ef318a43675c0640301fd77e.exe
Size

104KB
MD5

d6a62b97ef318a43675c0640301fd77e
SHA1

8273c75bd0657b73478e155f8106ff69d401ddd8
SHA256

723e114f727dae196785e4912453ff0116f93a829160bd7995c5671a5640105a
SHA512

4249c6cb1779cb28d751a10e37ac92db59137dac48a0334d0e663ad0ea518e954f5d9db73bad92b6ce24bb3f2ea15cad2130c0150d1f44c32fa06b800edd6866
SSDEEP

1536:nIKie+APavnM9CdC7NsaGQi4TJwqm4z2nexoJq5GWL3eGi5WN3T6d:2e3sICdC7aa3i0z2Kogk+3eGaWh

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\skbskg.dll	d6a62b97ef318a43675c0640301fd77e.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	d6a62b97ef318a43675c0640301fd77e.exe
File opened for modification	C:\Windows\SysWOW64\mjenpp.dll	d6a62b97ef318a43675c0640301fd77e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2136 set thread context of 1996	2136	d6a62b97ef318a43675c0640301fd77e.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2136	d6a62b97ef318a43675c0640301fd77e.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1996	2136	d6a62b97ef318a43675c0640301fd77e.exe	28
PID 2136 wrote to memory of 1996	2136	d6a62b97ef318a43675c0640301fd77e.exe	28
PID 2136 wrote to memory of 1996	2136	d6a62b97ef318a43675c0640301fd77e.exe	28
PID 2136 wrote to memory of 1996	2136	d6a62b97ef318a43675c0640301fd77e.exe	28
PID 2136 wrote to memory of 1996	2136	d6a62b97ef318a43675c0640301fd77e.exe	28
PID 2136 wrote to memory of 1996	2136	d6a62b97ef318a43675c0640301fd77e.exe	28
PID 2136 wrote to memory of 1996	2136	d6a62b97ef318a43675c0640301fd77e.exe	28
PID 2136 wrote to memory of 1996	2136	d6a62b97ef318a43675c0640301fd77e.exe	28
PID 2136 wrote to memory of 1996	2136	d6a62b97ef318a43675c0640301fd77e.exe	28
PID 2136 wrote to memory of 1996	2136	d6a62b97ef318a43675c0640301fd77e.exe	28
PID 2136 wrote to memory of 1996	2136	d6a62b97ef318a43675c0640301fd77e.exe	28

C:\Users\Admin\AppData\Local\Temp\d6a62b97ef318a43675c0640301fd77e.exe
"C:\Users\Admin\AppData\Local\Temp\d6a62b97ef318a43675c0640301fd77e.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe
  2⤵
  PID:1996

memory/1996-7-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1996-9-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1996-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1996-11-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2136-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2136-19-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download