24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d

Analysis

max time kernel
61s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 00:55

Target

24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d.exe
Size

62KB
MD5

0b0e39aae68bc1abbf1475545be24972
SHA1

f222afdae8f966b587a66b47b4e4162e293d2bc7
SHA256

24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d
SHA512

0076a0a21fa221146333a7c49cb610ed085d06c93a2d8c721abeabb763cd2ce0fa5484734d45a3ad0e3309492922ba1b5da3bcaae8edaf137cc7707834454191
SSDEEP

1536:s25b7AbekJQ2dfh+6TE7MWwP5GuqhcJ3YXj:N5bci6pJTE7U5GuqhcJ3Yz

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yoye20ot6e.exe	24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yoye20ot6e.exe	24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1212 set thread context of 1328	1212	24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d.exe	19

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1328	24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1328	1212	24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d.exe	19
PID 1212 wrote to memory of 1328	1212	24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d.exe	19
PID 1212 wrote to memory of 1328	1212	24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d.exe	19
PID 1212 wrote to memory of 1328	1212	24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d.exe	19
PID 1212 wrote to memory of 1328	1212	24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d.exe	19
PID 1212 wrote to memory of 1328	1212	24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d.exe	19
PID 1328 wrote to memory of 1216	1328	24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d.exe	17
PID 1328 wrote to memory of 1216	1328	24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d.exe	17
PID 1328 wrote to memory of 1216	1328	24faca4d49416295d3ef9fa81634b44cf893eaba1b815240dc9ff316cac8547d.exe	17

memory/1212-55-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1212-54-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1212-56-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/1212-61-0x0000000000420000-0x000000000043B000-memory.dmp

Filesize
108KB

Download
memory/1212-60-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1216-63-0x0000000002210000-0x0000000002213000-memory.dmp

Filesize
12KB

Download
memory/1328-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1328-58-0x0000000000401840-mapping.dmp

Download
memory/1328-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1328-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download