7a0fc390552b21b671a9f87934ab161bab03e08cef9383c24e66300894f14ec5

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 18:04

Target

VIP-CHAIR.exe
Size

5.6MB
MD5

1456d19f6e07ae3374e5c296f205a7e5
SHA1

21391320b8f27e7f8bbf9f25c0e97f58a82f5c28
SHA256

358e6a243ff184b5d0770e8c442a2a883257e925e66e2cb8c42e137d19059953
SHA512

0ccdbeeae6f05ebc8fae56b241e9ab9a090d5c3c771bcb9a6415c09f1217f02aa2e2465e4deb833c8a5d16139fb69e172d77c7c0dbf7ef25e217bc84a7319ba4
SSDEEP

98304:l5Po/g9kQoDuhk2M2uHSwfdnX/aqeAZnOIBggY5smGbirNFUM5p3KS:/o/EkJCduywkVAZnOIY5sJaAW3

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

VIP-CHAIR.exe

pid process

2368 VIP-CHAIR.exe
2368 VIP-CHAIR.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2656 timeout.exe

pid	process
2656	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

VIP-CHAIR.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

VIP-CHAIR.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2368 wrote to memory of 2160	2368	VIP-CHAIR.exe	cmd.exe
PID 2368 wrote to memory of 2160	2368	VIP-CHAIR.exe	cmd.exe
PID 2368 wrote to memory of 2160	2368	VIP-CHAIR.exe	cmd.exe
PID 2160 wrote to memory of 2220	2160	cmd.exe	certutil.exe
PID 2160 wrote to memory of 2220	2160	cmd.exe	certutil.exe
PID 2160 wrote to memory of 2220	2160	cmd.exe	certutil.exe
PID 2160 wrote to memory of 2648	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 2648	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 2648	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 2684	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 2684	2160	cmd.exe	find.exe
PID 2160 wrote to memory of 2684	2160	cmd.exe	find.exe
PID 2368 wrote to memory of 2664	2368	VIP-CHAIR.exe	cmd.exe
PID 2368 wrote to memory of 2664	2368	VIP-CHAIR.exe	cmd.exe
PID 2368 wrote to memory of 2664	2368	VIP-CHAIR.exe	cmd.exe
PID 2664 wrote to memory of 2544	2664	cmd.exe	cmd.exe
PID 2664 wrote to memory of 2544	2664	cmd.exe	cmd.exe
PID 2664 wrote to memory of 2544	2664	cmd.exe	cmd.exe
PID 2368 wrote to memory of 2840	2368	VIP-CHAIR.exe	WerFault.exe
PID 2368 wrote to memory of 2840	2368	VIP-CHAIR.exe	WerFault.exe
PID 2368 wrote to memory of 2840	2368	VIP-CHAIR.exe	WerFault.exe
PID 2544 wrote to memory of 2656	2544	cmd.exe	timeout.exe
PID 2544 wrote to memory of 2656	2544	cmd.exe	timeout.exe
PID 2544 wrote to memory of 2656	2544	cmd.exe	timeout.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\VIP-CHAIR.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
2⤵
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\system32\certutil.exe
certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\VIP-CHAIR.exe" MD5
3⤵
PID:2220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo Couldn't resolve host name && timeout /t 5"
2⤵
- Suspicious use of WriteProcessMemory
PID:2664

C:\Windows\system32\cmd.exe
cmd /C "color b && title Error && echo Couldn't resolve host name && timeout /t 5"
3⤵
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\system32\timeout.exe
timeout /t 5
4⤵
- Delays execution with timeout.exe
PID:2656

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2368 -s 264
2⤵
PID:2840

memory/2368-2-0x0000000077790000-0x0000000077792000-memory.dmp

Filesize
8KB

Download
memory/2368-4-0x0000000077790000-0x0000000077792000-memory.dmp

Filesize
8KB

Download
memory/2368-0-0x0000000077790000-0x0000000077792000-memory.dmp

Filesize
8KB

Download
memory/2368-6-0x000000013F500000-0x000000013FED2000-memory.dmp

Filesize
9.8MB

Download
memory/2368-7-0x000000013F599000-0x000000013F936000-memory.dmp

Filesize
3.6MB

Download
memory/2368-10-0x000000013F500000-0x000000013FED2000-memory.dmp

Filesize
9.8MB

Download