49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 18:25

Target

49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a.exe
Size

86KB
MD5

11c9f3dbe4bed32a36e34cbbe57d3840
SHA1

9328ee911e8eedefc4ea4d63e5f68d5afaa6a43a
SHA256

49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a
SHA512

4596b8a86e8c4a9bb5046f0ca47a0b47e69d092ae54b5be7fd618e47809fb5918badbf11531ed7f2ee2b6cfdb19cbfc2509e3433ce4f973ef5d1afdb890762ba
SSDEEP

768:N/IwI4gTtUReg/UXssPzfQE6rrDNswNX9pQUnbmhGOOOOOOOaHaJB4VQgvBAfBKb:ed4gTtUMgQzfWrrDNhLGKYBuOw

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tdy5ddj2t.exe	49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tdy5ddj2t.exe	49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1520 set thread context of 1656	1520	49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1656	49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1656	1520	49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a.exe	28
PID 1520 wrote to memory of 1656	1520	49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a.exe	28
PID 1520 wrote to memory of 1656	1520	49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a.exe	28
PID 1520 wrote to memory of 1656	1520	49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a.exe	28
PID 1520 wrote to memory of 1656	1520	49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a.exe	28
PID 1520 wrote to memory of 1656	1520	49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a.exe	28
PID 1656 wrote to memory of 1272	1656	49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a.exe	15
PID 1656 wrote to memory of 1272	1656	49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a.exe	15
PID 1656 wrote to memory of 1272	1656	49c426d1508fbe79f698a05763ee38164229229ccca6994d51cff110e979df6a.exe	15

memory/1272-62-0x0000000002640000-0x0000000002643000-memory.dmp

Filesize
12KB

Download
memory/1520-54-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1520-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1520-56-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1520-61-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1656-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1656-60-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1656-64-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download