9aa2c092cf546c89b3e3674e97d2c52c6025f3e185af91db277f13bb3fb1bd96

Analysis

max time kernel
98s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 15:06

Target

Clumsy 0.4 V2/WinDivert.dll
Size

15KB
MD5

1b1284100327d972e017f565dbecf80e
SHA1

5b4f0c122a80478973eb6f9cb3bbcaf186295aea
SHA256

9444a6e6b66f13f666f9c60d1935824f61c7256e35a8cf0440e29baa7fbe42c7
SHA512

4ccb9e233a3573f6eded0efa8fa54ed929818394cdf2153623d902c749d37751da6f489354aa50968e53d42d5ce339f6368dedb7858a4ff43a1927b4338954a4
SSDEEP

384:EHGiP0PYf9pHuGvATXlQRNq/EbUKxcneWuDlE:E9MQf90GvQXlQvAEcehD

Score

1^/10

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
476	Process not Found
476	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2672	clumsy.exe
1088	clumsy.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Clumsy 0.4 V2\WinDivert.dll",#1
1⤵
PID:2092

C:\Users\Admin\AppData\Local\Temp\Clumsy 0.4 V2\clumsy.exe
"C:\Users\Admin\AppData\Local\Temp\Clumsy 0.4 V2\clumsy.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:2672

C:\Users\Admin\AppData\Local\Temp\Clumsy 0.4 V2\clumsy.exe
"C:\Users\Admin\AppData\Local\Temp\Clumsy 0.4 V2\clumsy.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1088

memory/1088-6-0x000000013F760000-0x000000013F8E2000-memory.dmp

Filesize
1.5MB

Download
memory/1088-8-0x000000013F760000-0x000000013F8E2000-memory.dmp

Filesize
1.5MB

Download
memory/2672-1-0x0000000062800000-0x000000006280C000-memory.dmp

Filesize
48KB

Download
memory/2672-0-0x000000013FAE0000-0x000000013FC62000-memory.dmp

Filesize
1.5MB

Download
memory/2672-2-0x000000013FAE0000-0x000000013FC62000-memory.dmp

Filesize
1.5MB

Download
memory/2672-4-0x000000013FAE0000-0x000000013FC62000-memory.dmp

Filesize
1.5MB

Download