01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41

Analysis

max time kernel
153s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 11:14

Target

01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41.exe
Size

53KB
MD5

8d9b0fbb5e224b94ded1f68cd6fa591f
SHA1

f6044c9bc77a727ab87c1405b8efbae70250063e
SHA256

01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41
SHA512

1c6998846d86e521abfaa6aeeafd91b88e65f2af718a2b6857f5c7b5fc0db6035eac6daab96e24aa6b92729cb9e5b0930620a65278a8f50cc86b947b0359e229
SSDEEP

768:hnPgOe0010+0bnAJZG6+DZmmWjsrmcQiXRzCMiwOpjka80s+GO9Lx/Z5mSk+R:Vs0+EATGrYrjsrTR2MNaXs+GY/ZlR

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hdyy6pq7.exe	01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hdyy6pq7.exe	01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4384 set thread context of 3540	4384	01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3540	01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41.exe
3540	01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 3540	4384	01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41.exe	79
PID 4384 wrote to memory of 3540	4384	01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41.exe	79
PID 4384 wrote to memory of 3540	4384	01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41.exe	79
PID 4384 wrote to memory of 3540	4384	01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41.exe	79
PID 4384 wrote to memory of 3540	4384	01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41.exe	79
PID 3540 wrote to memory of 2424	3540	01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41.exe	54
PID 3540 wrote to memory of 2424	3540	01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41.exe	54
PID 3540 wrote to memory of 2424	3540	01101f2118432554ffa1f9d0263225af05f7f7680bf6224efe2e190e72b92e41.exe	54

memory/3540-135-0x0000000000000000-mapping.dmp

Download
memory/3540-136-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3540-138-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3540-140-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4384-132-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4384-133-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/4384-134-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4384-139-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download