5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79

Analysis

max time kernel
45s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 12:49

Target

5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79.exe
Size

61KB
MD5

04ee76dab6110200e5399380e117e095
SHA1

b3e422d698d1e25d7ef61c69a72fd489195258d2
SHA256

5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79
SHA512

fcabf5bdc9bab43dc51e8a1d3cbd588e412692edf104e1093c2069e46b39ceb961b78be563854cea3a0a2c2e10c760626cd1359db41dfe421ae1970dbc8b73f0
SSDEEP

1536:PeViGBz6OGTCYr+Fc2Y7hofRtL7jnwua6o3/jkGZ:kWtr+3KsR9cuVovtZ

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tdyy1jo95.exe	5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tdyy1jo95.exe	5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 1204	1672	5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1204	5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1204	1672	5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79.exe	27
PID 1672 wrote to memory of 1204	1672	5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79.exe	27
PID 1672 wrote to memory of 1204	1672	5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79.exe	27
PID 1672 wrote to memory of 1204	1672	5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79.exe	27
PID 1672 wrote to memory of 1204	1672	5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79.exe	27
PID 1672 wrote to memory of 1204	1672	5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79.exe	27
PID 1204 wrote to memory of 1212	1204	5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79.exe	14
PID 1204 wrote to memory of 1212	1204	5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79.exe	14
PID 1204 wrote to memory of 1212	1204	5ebb407c682d261db47fa5325ed595408cba2e365b683e48bd45c0328e420c79.exe	14

memory/1204-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1204-60-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1204-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1212-63-0x00000000027A0000-0x00000000027A3000-memory.dmp

Filesize
12KB

Download
memory/1672-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1672-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1672-56-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1672-61-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1672-62-0x0000000000420000-0x000000000043A000-memory.dmp

Filesize
104KB

Download