5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b

Analysis

max time kernel
15s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 08:45

Target

5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b.exe
Size

76KB
MD5

fe46ad684388c93ebcac5c7b02e74a41
SHA1

5370165094b0d18d0a9cc124adad6cb9cfcdb882
SHA256

5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b
SHA512

4b0e04a6ba5015c899d88f48ebce7e9b48319c17f2062da1fb8627fb000c5e9af80ceb89c579b091cdd5435a95fc2298348f589abdf1507eabe002d4e439224f
SSDEEP

1536:daHou8wtCVwvNKH2hjH3ww3EphhSJ0FBca:daIu9tg7Whz3ww3E7MJUBz

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5etete2.exe	5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5etete2.exe	5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1648 set thread context of 2004	1648	5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2004	5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2004	1648	5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b.exe	27
PID 1648 wrote to memory of 2004	1648	5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b.exe	27
PID 1648 wrote to memory of 2004	1648	5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b.exe	27
PID 1648 wrote to memory of 2004	1648	5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b.exe	27
PID 1648 wrote to memory of 2004	1648	5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b.exe	27
PID 1648 wrote to memory of 2004	1648	5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b.exe	27
PID 2004 wrote to memory of 1420	2004	5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b.exe	10
PID 2004 wrote to memory of 1420	2004	5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b.exe	10
PID 2004 wrote to memory of 1420	2004	5e3db239a24ae3a8dfe805df30ea6f74569bdeacfb2b8591607d7deef7bd591b.exe	10

memory/1420-63-0x0000000002280000-0x0000000002283000-memory.dmp

Filesize
12KB

Download
memory/1648-54-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1648-55-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1648-56-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1648-61-0x0000000001F10000-0x0000000001F2E000-memory.dmp

Filesize
120KB

Download
memory/1648-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2004-58-0x0000000000401840-mapping.dmp

Download
memory/2004-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2004-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2004-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download