4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 00:44

Target

4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe
Size

54KB
MD5

086025aaa482093ca4a82c87647e18e8
SHA1

41e1e3b3a0149d681c9578052dd3244e8f50fe61
SHA256

4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156
SHA512

43388eec999fdb7d0d2922148a9f479316ca54d89ee08905c324a68b44fa38bf9a4664c744556f15189d1762f75d0ec0ad231e6dd2f9a84f8b75c46cb3be577d
SSDEEP

768:QWvYqsI6ph5gl69z8bmi6m8+/U0te9nzjAJMcGhDWIO2GmZLfHIOOM59:U1Gl69z8t6m8Dzc2WIVL

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2j8tdtd.exe	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2j8tdtd.exe	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1740 set thread context of 1316	1740	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1316	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1316	1740	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	27
PID 1740 wrote to memory of 1316	1740	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	27
PID 1740 wrote to memory of 1316	1740	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	27
PID 1740 wrote to memory of 1316	1740	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	27
PID 1740 wrote to memory of 1316	1740	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	27
PID 1740 wrote to memory of 1316	1740	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	27
PID 1316 wrote to memory of 1204	1316	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	17
PID 1316 wrote to memory of 1204	1316	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	17
PID 1316 wrote to memory of 1204	1316	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	17

memory/1204-63-0x0000000002AA0000-0x0000000002AA3000-memory.dmp

Filesize
12KB

Download
memory/1316-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1316-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1316-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1740-54-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1740-55-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/1740-56-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1740-57-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1740-60-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download