c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a

Analysis

max time kernel
31s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 21:43

Target

c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a.exe
Size

72KB
MD5

a0bb1ceb909e243ca5b216bc6f727f9d
SHA1

c5f5948a56cbd57500b30bcb67bdbd5a9ca0f5fc
SHA256

c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a
SHA512

ed6a2d4aa31c447f88f9e3c64b3eb9254cb6e5b0aedd61d3740c52b08d7c6b675c91e21a0c78f4a54ba46d4a9746a74e91ff78442a23c2265cf27aef8f41dcd9
SSDEEP

768:kMYC5JvbYdbf2QOGUTDMVPcQFZUdvbQ/fM5dX+9NTkbjyb64Zhti5lNBWIOJm/A5:kMP5Jvb/GUPMWLpbQ/UTO7TkiU9OAA5

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jtjt6te7e.exe	c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jtjt6te7e.exe	c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1344 set thread context of 1284	1344	c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1284	c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1284	1344	c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a.exe	26
PID 1344 wrote to memory of 1284	1344	c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a.exe	26
PID 1344 wrote to memory of 1284	1344	c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a.exe	26
PID 1344 wrote to memory of 1284	1344	c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a.exe	26
PID 1344 wrote to memory of 1284	1344	c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a.exe	26
PID 1344 wrote to memory of 1284	1344	c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a.exe	26
PID 1284 wrote to memory of 1188	1284	c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a.exe	11
PID 1284 wrote to memory of 1188	1284	c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a.exe	11
PID 1284 wrote to memory of 1188	1284	c8093e62dae8d6dd3d6dc9309ff1b53d41630f477c39359e1891f628f88dea6a.exe	11

memory/1188-63-0x0000000001DD0000-0x0000000001DD3000-memory.dmp

Filesize
12KB

Download
memory/1284-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1284-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1284-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1344-54-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1344-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1344-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1344-57-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1344-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download