6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b

Analysis

max time kernel
73s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 08:06

Target

6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b.exe
Size

72KB
MD5

18a8b9ed9c3764d5587d20ec0b6afcbd
SHA1

e1409ba09890b5b6324eb1b9ffbbd3abe3b7da2e
SHA256

6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b
SHA512

e1bce4621c310947e1244adb198e107ea5f992c656453d7b04877f9f3bd05b3c5b8b516f691659343cff66444e33112b995c6c08c4b1db6d554ab9ff425d66ea
SSDEEP

1536:/ZR5l0GUPMWLpbQ/UTO7wCA3M4twLtJsABra:xdUrcc9vLt8LBr

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\etjzz5e3.exe	6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\etjzz5e3.exe	6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 572	1744	6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
572	6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 572	1744	6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b.exe	28
PID 1744 wrote to memory of 572	1744	6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b.exe	28
PID 1744 wrote to memory of 572	1744	6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b.exe	28
PID 1744 wrote to memory of 572	1744	6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b.exe	28
PID 1744 wrote to memory of 572	1744	6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b.exe	28
PID 1744 wrote to memory of 572	1744	6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b.exe	28
PID 572 wrote to memory of 1256	572	6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b.exe	14
PID 572 wrote to memory of 1256	572	6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b.exe	14
PID 572 wrote to memory of 1256	572	6dc2432de9cb821f3313e7f58360db502ce7fb25c2b7cd4443eeb4c4ce8afd9b.exe	14

memory/572-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/572-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/572-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1256-63-0x0000000002A50000-0x0000000002A53000-memory.dmp

Filesize
12KB

Download
memory/1744-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1744-54-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1744-56-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download
memory/1744-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1744-61-0x0000000001D60000-0x0000000001D7C000-memory.dmp

Filesize
112KB

Download