6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 06:10

Target

6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755.exe
Size

75KB
MD5

e221383dca68d53e2a32477f37a68727
SHA1

4d98144da360d8264538ecc9c2e532925ecd227e
SHA256

6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755
SHA512

27e8e5448d470274215086590d7ebaec6a9b1da656acacfb26a58ff43e25c158488d9c700e95e2ec68af4ffaa1e22cffb7ef30f997a9af29e4e1a53ca5ffb624
SSDEEP

768:i5tj6T6ixRjuwRDCaI3lhjtDw/XZd9Kbjobh7v8X1w1mqspegyV0DIEq+:i5tjMNMwtCVwvNKH2hr84spPsq

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jdo7oytty.exe	6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jdo7oytty.exe	6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1220 set thread context of 896	1220	6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
896	6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 896	1220	6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755.exe	26
PID 1220 wrote to memory of 896	1220	6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755.exe	26
PID 1220 wrote to memory of 896	1220	6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755.exe	26
PID 1220 wrote to memory of 896	1220	6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755.exe	26
PID 1220 wrote to memory of 896	1220	6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755.exe	26
PID 1220 wrote to memory of 896	1220	6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755.exe	26
PID 896 wrote to memory of 1284	896	6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755.exe	16
PID 896 wrote to memory of 1284	896	6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755.exe	16
PID 896 wrote to memory of 1284	896	6dbec9afad3af93e248a28d2fe4a6a24245510946a9f3a11e77afda1eed87755.exe	16

memory/896-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/896-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/896-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1220-54-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1220-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1220-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1220-57-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/1220-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1284-63-0x0000000002200000-0x0000000002203000-memory.dmp

Filesize
12KB

Download