5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22

Analysis

max time kernel
63s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 12:53

Target

5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22.exe
Size

54KB
MD5

07e38f7f6f1072cc819172e88e6d11e0
SHA1

60978589656330f403bd3b0e50906a78d575314f
SHA256

5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22
SHA512

7d3c4e6961ec65a41a026441c6417e95cc6cc56d2c370a69d28428140490834e8094f406e5baa3a6d348c596f7be9e90bb9c4a099e90ed710f1b7bdd3051c319
SSDEEP

1536:hvoU08lc3Z2kJUYHusEJJr2/TYYJn0GmQbe3wvLWy9sACc5zCzpB:rL4Z2exTAF2/TYC0Ue3w59sz6z+f

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yteyjojty.exe	5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yteyjojty.exe	5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1464 set thread context of 1312	1464	5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1312	5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1312	1464	5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22.exe	28
PID 1464 wrote to memory of 1312	1464	5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22.exe	28
PID 1464 wrote to memory of 1312	1464	5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22.exe	28
PID 1464 wrote to memory of 1312	1464	5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22.exe	28
PID 1464 wrote to memory of 1312	1464	5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22.exe	28
PID 1464 wrote to memory of 1312	1464	5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22.exe	28
PID 1312 wrote to memory of 1432	1312	5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22.exe	11
PID 1312 wrote to memory of 1432	1312	5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22.exe	11
PID 1312 wrote to memory of 1432	1312	5b7cac02958fdd62da60fdc59dd9b6aadec4f926711d79eb19c66ae618f1cc22.exe	11

memory/1312-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1312-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1312-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1432-63-0x00000000021F0000-0x00000000021F3000-memory.dmp

Filesize
12KB

Download
memory/1464-54-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1464-56-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1464-55-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/1464-57-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1464-62-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download