File name:

dd.exe

Full analysis: https://app.any.run/tasks/64a37d7f-60d3-441d-a431-992e5b711fdf
Verdict: Malicious activity
Analysis date: November 05, 2024, 14:38:51
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 6 sections
MD5:

761510C85D347F8ED337B49BDD7770A6

SHA1:

B51575F6CD3A88B25149A23D8B44249F52A10953

SHA256:

C204DC4C06D97A3DF65A36ECE3EAD1800CDC74F295E23F9FD58ED545E7F0A2A7

SSDEEP:

98304:xDZMBEWwombEuYh3SfLg5073YVmb50EhiwOQcrfORUYzqAqo33MYfZ92HC48HI6H:rynzyrrx8XHyi/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • dd.exe (PID: 3912)

    • Application launched itself

      • dd.exe (PID: 3912)

    • Executable content was dropped or overwritten

      • dd.exe (PID: 3912)

    • Process drops python dynamic module

      • dd.exe (PID: 3912)

    • The process drops C-runtime libraries

      • dd.exe (PID: 3912)

  • INFO

    • Create files in a temporary directory

      • dd.exe (PID: 3912)

    • Checks supported languages

      • dd.exe (PID: 3912)

    • Reads the computer name

      • dd.exe (PID: 3912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:08:30 15:30:41+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 173056
InitializedDataSize: 151040
UninitializedDataSize: -
EntryPoint: 0xb4d0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dd.exe conhost.exe no specs dd.exe no specs sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3824\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—dd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3912"C:\Users\admin\AppData\Local\Temp\dd.exe" C:\Users\admin\AppData\Local\Temp\dd.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\dd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4436"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4956C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6372"C:\Users\admin\AppData\Local\Temp\dd.exe" C:\Users\admin\AppData\Local\Temp\dd.exe—dd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\dd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
318
Read events
318
Write events
0
Delete events
0

Modification events

No data
Executable files
67
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3912dd.exeC:\Users\admin\AppData\Local\Temp\_MEI39122\VCRUNTIME140.dllexecutable
MD5:870FEA4E961E2FBD00110D3783E529BE
SHA256:76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
3912dd.exeC:\Users\admin\AppData\Local\Temp\_MEI39122\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:D7AD8DB12FF42D620A657127DADA1D88
SHA256:26054D8FEBAB1AACF11AA5CB64055808CD33388A8E77D0B3BCBC7543B0EEA3BD
3912dd.exeC:\Users\admin\AppData\Local\Temp\_MEI39122\_socket.pydexecutable
MD5:0FC65EC300553D8070E6B44B9B23B8C0
SHA256:360744663FCE8DEC252ABBDA1168F470244FDB6DA5740BB7AB3171E19106E63C
3912dd.exeC:\Users\admin\AppData\Local\Temp\_MEI39122\_ssl.pydexecutable
MD5:93905020F4158C5119D16EE6792F8057
SHA256:D9CC4358D9351FED11EEC03753A8FA8ED981A6C2246BBD7CB0B0A3472C09FDC4
3912dd.exeC:\Users\admin\AppData\Local\Temp\_MEI39122\_lzma.pydexecutable
MD5:3230404A7191C6228A8772D3610E49E5
SHA256:33AE42F744D2688BB7D5519F32FF7B7489B96F4EEA47F66D2009DBA6A0023903
3912dd.exeC:\Users\admin\AppData\Local\Temp\_MEI39122\_decimal.pydexecutable
MD5:A1FFC2A156E9266932C351A88E5E7FAB
SHA256:B8409829DC4FDE70F38754DE55D3090A1CD52C78FFECE2A08572A58DE3AF294D
3912dd.exeC:\Users\admin\AppData\Local\Temp\_MEI39122\_hashlib.pydexecutable
MD5:F419AC6E11B4138EEA1FE8C86689076A
SHA256:441D32922122E59F75A728CC818F8E50613866A6C3DEC627098E6CC6C53624E2
3912dd.exeC:\Users\admin\AppData\Local\Temp\_MEI39122\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:C68A86C180FF1FCAC90D1DA9A08179C1
SHA256:2C91C4861E88C92693A1B145EBE2F69FFB90797CD42061E2D84F3D7FC009A941
3912dd.exeC:\Users\admin\AppData\Local\Temp\_MEI39122\_elementtree.pydexecutable
MD5:F12B69DF1E983913E7F870EB8E79BC29
SHA256:B7EC9604084FA090135032633A38B0564F3F5F37FE1446197D008B78975E0418
3912dd.exeC:\Users\admin\AppData\Local\Temp\_MEI39122\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:4A8F3A1847F216B8AC3E6B53BC20BD81
SHA256:29B7D786D9F421765A4F4904F79605C41E17C0A24D7F91E44C0B7B0DEA489FC3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
40
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5488
MoUsoCoreWorker.exe
GET
200
2.19.198.194:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2076
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3620
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6184
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6184
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
5588
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
2.19.198.194:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6944
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4360
SearchApp.exe
2.16.204.157:443
www.bing.com
Akamai International B.V.
DE
whitelisted
2076
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.19.198.194
  • 23.32.238.34
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.206
whitelisted
www.bing.com
  • 2.16.204.157
  • 2.16.204.138
  • 2.16.204.146
  • 2.16.204.135
  • 2.16.204.143
  • 2.16.204.137
  • 2.16.204.136
  • 2.16.204.134
  • 2.16.204.151
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.2
  • 20.190.159.4
  • 20.190.159.68
  • 40.126.31.69
  • 20.190.159.64
  • 40.126.31.73
  • 40.126.31.67
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
th.bing.com
  • 2.16.204.141
  • 2.16.204.160
  • 2.16.204.138
  • 2.16.204.143
  • 2.16.204.134
  • 2.16.204.136
  • 2.16.204.135
  • 2.16.204.158
  • 2.16.204.148
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dd.exe