7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47

Analysis

max time kernel
69s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/10/2022, 10:42

Target

7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47.exe
Size

36KB
MD5

6d310f21236ebc015734ad95c528c9e2
SHA1

fc640d3c93e7ef8e2214ce07e85b54e57c163310
SHA256

7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47
SHA512

e54697eeda64aece35a4a98ac588c536f247154c8f818deaf0cbe547975488603cd28cf87e49a7eeebebfd3b6020ab7d3fa97e13b071b67661df3afc9b364d6c
SSDEEP

768:ZcmtTXM2YZU9ZFOjLFyaBpBoy8KDbZS2nCyH5UmZ:OyTXU29ZwcAHokZXnCyH5

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1236	nyrtuc.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\nyrtuc.exe	7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47.exe
File opened for modification	C:\Windows\SysWOW64\nyrtuc.exe	7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1236 set thread context of 1784	1236	nyrtuc.exe	28

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1968	7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1968	7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47.exe
1968	7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47.exe
1236	nyrtuc.exe
1236	nyrtuc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1784	1236	nyrtuc.exe	28
PID 1236 wrote to memory of 1784	1236	nyrtuc.exe	28
PID 1236 wrote to memory of 1784	1236	nyrtuc.exe	28
PID 1236 wrote to memory of 1784	1236	nyrtuc.exe	28
PID 1236 wrote to memory of 1784	1236	nyrtuc.exe	28
PID 1236 wrote to memory of 1784	1236	nyrtuc.exe	28

C:\Windows\SysWOW64\nyrtuc.exe

Filesize
36KB

MD5
6d310f21236ebc015734ad95c528c9e2

SHA1
fc640d3c93e7ef8e2214ce07e85b54e57c163310

SHA256
7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47

SHA512
e54697eeda64aece35a4a98ac588c536f247154c8f818deaf0cbe547975488603cd28cf87e49a7eeebebfd3b6020ab7d3fa97e13b071b67661df3afc9b364d6c

Download Submit
C:\Windows\SysWOW64\nyrtuc.exe

Filesize
36KB

MD5
6d310f21236ebc015734ad95c528c9e2

SHA1
fc640d3c93e7ef8e2214ce07e85b54e57c163310

SHA256
7d56e6e6ffdd82040c1045aea14d0cbc2a0d169ecff6451bc353d07660573a47

SHA512
e54697eeda64aece35a4a98ac588c536f247154c8f818deaf0cbe547975488603cd28cf87e49a7eeebebfd3b6020ab7d3fa97e13b071b67661df3afc9b364d6c

Download Submit
memory/1784-58-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1784-60-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1968-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download