e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 21:25

Target

e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059.exe
Size

86KB
MD5

91fbb1c9e66aed72ae81439360b99770
SHA1

945712a00da4d304e345b7353c0d6a4cd04293d0
SHA256

e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059
SHA512

889b65fda1fa02a1c84849b0cbf265ffaab787f9e51a78f4c5cbc907242fea0115298e8a0440913589d6c126559e440582ea09c37000f9ea2a44d54032585b41
SSDEEP

1536:iMP5xvb/GUPMWLpbQ/UTO7TkiU9OAA5JL3sF1:VvbeUrcclXM3DTsD

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oyt7yd7d.exe	e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oyt7yd7d.exe	e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 988	2032	e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
988	e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 988	2032	e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059.exe	27
PID 2032 wrote to memory of 988	2032	e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059.exe	27
PID 2032 wrote to memory of 988	2032	e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059.exe	27
PID 2032 wrote to memory of 988	2032	e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059.exe	27
PID 2032 wrote to memory of 988	2032	e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059.exe	27
PID 2032 wrote to memory of 988	2032	e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059.exe	27
PID 988 wrote to memory of 1368	988	e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059.exe	15
PID 988 wrote to memory of 1368	988	e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059.exe	15
PID 988 wrote to memory of 1368	988	e6fe123e3594d7d45b980404d50c0fad2229ef68eeaeba3b0f9fb805d87a3059.exe	15

memory/988-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/988-60-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/988-64-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1368-62-0x0000000002590000-0x0000000002593000-memory.dmp

Filesize
12KB

Download
memory/2032-54-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2032-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2032-56-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2032-61-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download