Find similar analyses in TI Lookup

Analysis date (UTC): 28 January 2019, 06:30Analysis environment: Windows 7 Pro, build 7601, x86

a.exe

MD5:8E67F4C98754A2373A49EAF53425D79A

SHA1:C35902497EC15C48FDE130BF23F3D9E6F8F5527A

SHA256:0752F86B7C1C2B053B3EB4F1B60C046BB114AF56882F512B657728F14749CBC9

Analysis result

Threat level:Malicious activity

Full analysis:Analysis a.exe (MD5: 8E67F4C98754A2373A49EAF53425D79A) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

Starts CMD.EXE for commands execution

a.exe (PID: 2980)
SunGardStorageClient.exe (PID: 3740)
a.exe (PID: 3904)
PacketVMArranger.exe (PID: 3928)

Uses WMIC.EXE to create a new process

cmd.exe (PID: 2772)
cmd.exe (PID: 3184)
cmd.exe (PID: 1632)
cmd.exe (PID: 3440)
cmd.exe (PID: 3820)
cmd.exe (PID: 2464)

Executable content was dropped or overwritten

Wscript.exe (PID: 2696)
Wscript.exe (PID: 3424)
Wscript.exe (PID: 2180)
Wscript.exe (PID: 2776)

Creates files in the program directory

Wscript.exe (PID: 3424)
Wscript.exe (PID: 2696)
SunGardStorageClient.exe (PID: 3740)
Wscript.exe (PID: 2180)
Wscript.exe (PID: 2776)

INFO

Application was crashed

SunGardStorageClient.exe (PID: 3740)
PacketVMArranger.exe (PID: 3928)

Threats

No threats detected