b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e

Analysis

max time kernel
256s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30/11/2022, 22:54

Target

b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e.exe
Size

72KB
MD5

72007d2c10b24291df87c007fdcbd01f
SHA1

524f1b0306d076e4ec0d07556672748d224833e6
SHA256

b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e
SHA512

6c4a5be7939fba29b2fdca8935f61a5932ccbc3f2543d3b80f3237a6410d88933b46d10b8f9184a17c4084fa6747a8f7402fa52972b2fa28f557e169e562f00e
SSDEEP

1536:wZR5M0GUPMWLpbQ/UTO7wCA3M4twLtJsABras:omUrcc9vLt8LBrH

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkpzk3p3u.exe	b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkpzk3p3u.exe	b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1792 set thread context of 684	1792	b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
684	b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 684	1792	b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e.exe	28
PID 1792 wrote to memory of 684	1792	b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e.exe	28
PID 1792 wrote to memory of 684	1792	b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e.exe	28
PID 1792 wrote to memory of 684	1792	b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e.exe	28
PID 1792 wrote to memory of 684	1792	b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e.exe	28
PID 1792 wrote to memory of 684	1792	b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e.exe	28
PID 684 wrote to memory of 1372	684	b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e.exe	19
PID 684 wrote to memory of 1372	684	b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e.exe	19
PID 684 wrote to memory of 1372	684	b5a5dd09d76045532e69732420df0c1718f1ffb7edf59cae5e16c71ab449348e.exe	19

memory/684-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/684-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/684-64-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1372-62-0x00000000026D0000-0x00000000026D3000-memory.dmp

Filesize
12KB

Download
memory/1792-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1792-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1792-56-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download
memory/1792-59-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download