4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 00:44

Target

4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe
Size

54KB
MD5

086025aaa482093ca4a82c87647e18e8
SHA1

41e1e3b3a0149d681c9578052dd3244e8f50fe61
SHA256

4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156
SHA512

43388eec999fdb7d0d2922148a9f479316ca54d89ee08905c324a68b44fa38bf9a4664c744556f15189d1762f75d0ec0ad231e6dd2f9a84f8b75c46cb3be577d
SSDEEP

768:QWvYqsI6ph5gl69z8bmi6m8+/U0te9nzjAJMcGhDWIO2GmZLfHIOOM59:U1Gl69z8t6m8Dzc2WIVL

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\k75w75i75.exe	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\k75w75i75.exe	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4656 set thread context of 1476	4656	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1476	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe
1476	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1476	4656	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	86
PID 4656 wrote to memory of 1476	4656	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	86
PID 4656 wrote to memory of 1476	4656	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	86
PID 4656 wrote to memory of 1476	4656	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	86
PID 4656 wrote to memory of 1476	4656	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	86
PID 1476 wrote to memory of 3068	1476	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	41
PID 1476 wrote to memory of 3068	1476	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	41
PID 1476 wrote to memory of 3068	1476	4dae21f167b8ab02c82680f8f7a127321e9adf768215aa4a8b39bdc1c3637156.exe	41

memory/1476-139-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1476-141-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1476-143-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4656-135-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4656-137-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4656-136-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/4656-142-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download