We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
7 October 2021, 10:29
Analysis environment:
Windows 7 Pro, build 7601, x86
45593a7071903724aae4974d478a17784cfca63af4d3404312fb4b5ecb9e0f1c
MD5:
D5DF5B266FC8C9AF26F6593F8EA771A8
SHA1:
B786A7C78B746CDA42F49211FC2E437AF17D1CE4
SHA256:
45593A7071903724AAE4974D478A17784CFCA63AF4D3404312FB4B5ECB9E0F1C
Analysis result
Threat level:
Malicious activity
Full analysis:
Analysis 45593a7071903724aae4974d478a17784cfca63af4d3404312fb4b5ecb9e0f1c (MD5: D5DF5B266FC8C9AF26F6593F8EA771A8) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Drops executable file immediately after starts
cmd.exe (PID: 3388)
Application was dropped or rewritten from another process
ie4uinit.exe (PID: 3732)
ie4uinit.exe (PID: 856)
SUSPICIOUS
Executable content was dropped or overwritten
cmd.exe (PID: 3388)
Creates files in the user directory
cmd.exe (PID: 3388)
Checks supported languages
cmd.exe (PID: 3388)
WMIC.exe (PID: 1876)
ie4uinit.exe (PID: 856)
ie4uinit.exe (PID: 3732)
Uses WMIC.EXE to create a new process
cmd.exe (PID: 3388)
Drops a file that was compiled in debug mode
cmd.exe (PID: 3388)
Reads the computer name
WMIC.exe (PID: 1876)
ie4uinit.exe (PID: 856)
ie4uinit.exe (PID: 3732)
Executed via WMI
ie4uinit.exe (PID: 856)
Application launched itself
ie4uinit.exe (PID: 856)
Creates files in the Windows directory
ie4uinit.exe (PID: 856)
Removes files from Windows directory
ie4uinit.exe (PID: 856)
INFO
No info indicators.
Threats
No threats detected