6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6

Analysis

max time kernel
43s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 08:14

Target

6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6.exe
Size

58KB
MD5

733823b46a5e93d5fbf1d7bb8959ac2e
SHA1

0d3253f79649e021d9d715b8a972488e3694aede
SHA256

6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6
SHA512

dff2bb07309e9c40356a76e5c342a1de098faf178d994d4245f4326a8f7eb1bd8552e4268b9936e1b683a71e38aad300e8c9598fea4e48aed3073867c80242ed
SSDEEP

768:tN2ZiUzAr4rS6heyY1soCG4UQmqdoZc3Fr7FCTvg4208pUPAzNPyYUhuQvL:tNmi4uSS6MyYuoqUQmooZcKTvgAAzQD

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dj2tootyd.exe	6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dj2tootyd.exe	6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1700 set thread context of 984	1700	6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
984	6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 984	1700	6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6.exe	27
PID 1700 wrote to memory of 984	1700	6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6.exe	27
PID 1700 wrote to memory of 984	1700	6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6.exe	27
PID 1700 wrote to memory of 984	1700	6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6.exe	27
PID 1700 wrote to memory of 984	1700	6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6.exe	27
PID 1700 wrote to memory of 984	1700	6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6.exe	27
PID 984 wrote to memory of 1280	984	6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6.exe	17
PID 984 wrote to memory of 1280	984	6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6.exe	17
PID 984 wrote to memory of 1280	984	6a2c896228b79a22998a7b314f26eacaa2bd78b7d0bc4b357f877d47d940e2c6.exe	17

memory/984-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/984-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/984-64-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1280-62-0x0000000002A40000-0x0000000002A43000-memory.dmp

Filesize
12KB

Download
memory/1700-55-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1700-54-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/1700-56-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1700-59-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download