8a742f5f51f903e4e83bd93bcd33a5ff694fbf6703566c9bd755864c6d23dd84

Analysis

max time kernel
33s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 13:58

Target

popup.vxm.exe
Size

2.4MB
MD5

aea6849fc867b25be94f4c016756fdee
SHA1

fa419d220a57b7bceb6dfa0614fa47612def278b
SHA256

8a742f5f51f903e4e83bd93bcd33a5ff694fbf6703566c9bd755864c6d23dd84
SHA512

d99640eeeab7afc8ca53afe1f5080a57ad1421fe58e5ff1598dddaf83599d2fea77486363001673abd4b2a51e65d16453b9457e627c33b8a586fc5d6dd36fb13
SSDEEP

49152:ggYbdcy+pyw20465ay4c45xAc9ow1+uiyo5W6qreDppVF:bedcVpyT046Yy4coxBdUuPo58epf

Score

5^/10

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2564-9-0x0000000003070000-0x00000000033D3000-memory.dmp	autoit_exe
behavioral1/memory/2564-7-0x0000000003070000-0x00000000033D3000-memory.dmp	autoit_exe
behavioral1/memory/2564-10-0x0000000003070000-0x00000000033D3000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2552	2564	popup.vxm.exe	30
PID 2564 wrote to memory of 2552	2564	popup.vxm.exe	30
PID 2564 wrote to memory of 2552	2564	popup.vxm.exe	30

C:\Users\Admin\AppData\Local\Temp\popup.vxm.exe
"C:\Users\Admin\AppData\Local\Temp\popup.vxm.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2564 -s 404
  2⤵
  PID:2552

memory/2564-1-0x0000000140000000-0x0000000140363000-memory.dmp

Filesize
3.4MB

Download
memory/2564-2-0x0000000140000000-0x0000000140363000-memory.dmp

Filesize
3.4MB

Download
memory/2564-0-0x0000000140000000-0x0000000140363000-memory.dmp

Filesize
3.4MB

Download
memory/2564-3-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/2564-4-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/2564-5-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/2564-6-0x0000000003070000-0x00000000033D3000-memory.dmp

Filesize
3.4MB

Download
memory/2564-9-0x0000000003070000-0x00000000033D3000-memory.dmp

Filesize
3.4MB

Download
memory/2564-7-0x0000000003070000-0x00000000033D3000-memory.dmp

Filesize
3.4MB

Download
memory/2564-10-0x0000000003070000-0x00000000033D3000-memory.dmp

Filesize
3.4MB

Download