6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1

Analysis

max time kernel
38s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 23:05

Target

6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1.exe
Size

65KB
MD5

1222d54ffaf8a9767d8fd586e4713207
SHA1

1f77d2be88928024a4b9203aac76093d3763bb26
SHA256

6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1
SHA512

e854e39c4f25dec82a07b36e7c95f4e5ce3533d4178f1438d70c4473b715e468922b974b841a14fa4c1ce518a88bdf2cb83f3153a14f2e3b3e7b6311060f6e64
SSDEEP

1536:c/dvQFZ7Fxqlq+MLMRqyBpB+j5eBYGp4mh:c/dv2ZFxqMFyBpglYvim

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yjyjoj7o.exe	6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yjyjoj7o.exe	6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1896 set thread context of 2008	1896	6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2008	6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2008	1896	6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1.exe	28
PID 1896 wrote to memory of 2008	1896	6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1.exe	28
PID 1896 wrote to memory of 2008	1896	6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1.exe	28
PID 1896 wrote to memory of 2008	1896	6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1.exe	28
PID 1896 wrote to memory of 2008	1896	6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1.exe	28
PID 1896 wrote to memory of 2008	1896	6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1.exe	28
PID 2008 wrote to memory of 1244	2008	6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1.exe	7
PID 2008 wrote to memory of 1244	2008	6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1.exe	7
PID 2008 wrote to memory of 1244	2008	6bb88b7a35231d78dda73d6a707769843d49fd2d1a54af3589d2ba5cf749f5d1.exe	7

memory/1244-62-0x00000000029E0000-0x00000000029E3000-memory.dmp

Filesize
12KB

Download
memory/1896-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1896-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1896-56-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1896-60-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2008-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2008-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2008-64-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download