9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19

Analysis

max time kernel
296s
max time network
308s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 00:40

Target

9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19.exe
Size

39KB
MD5

8482bcb3f6552b2e80f2623375547c00
SHA1

753b20343f92e06b67a317440dd4c8d30dd5f875
SHA256

9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19
SHA512

b81f63a97e56b0c941a80d82a4e4ca9abeebe7368fcf4187746f1fc1c5c0b8f15cd3feb341fa4d3c845d5a506907d4e86dfe977d36563200efa8d304f697f54c
SSDEEP

768:sEgHqpvz3TSNLyN5KVz3Ldubnbh5owckrRvwr3VAU/Y:ngHqhz3TSNLK+z7Abn15o0rR4rFAU/

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e6qq6cc6.exe	9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e6qq6cc6.exe	9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3696 set thread context of 3604	3696	9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3604	9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19.exe
3604	9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 3604	3696	9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19.exe	81
PID 3696 wrote to memory of 3604	3696	9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19.exe	81
PID 3696 wrote to memory of 3604	3696	9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19.exe	81
PID 3696 wrote to memory of 3604	3696	9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19.exe	81
PID 3696 wrote to memory of 3604	3696	9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19.exe	81
PID 3604 wrote to memory of 2620	3604	9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19.exe	52
PID 3604 wrote to memory of 2620	3604	9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19.exe	52
PID 3604 wrote to memory of 2620	3604	9305c272c1180ee7534428e575bd0f7bf228cb5c9103095221256468aa6bce19.exe	52

memory/3604-135-0x0000000000000000-mapping.dmp

Download
memory/3604-136-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3604-138-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3604-140-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3696-133-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3696-134-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3696-139-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download