9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9

Analysis

max time kernel
304s
max time network
346s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 01:18

Target

9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9.exe
Size

53KB
MD5

f46cc8f709b35875d0c61ce05e7658f5
SHA1

7c2e2d7d922a99cd62ac06a6ba48611a0136cf4b
SHA256

9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9
SHA512

99fdd93c11e7b087d6eb73b8ccb1aec51be30b38c17ea4436dab8687aeffede27ec57c76e5173d215bc516fe062291502b1c175131da8651387ff95be89b0940
SSDEEP

768:+wqPoOI10efB86tZf8C/PPbLlg35Lz+uJlOVhrbjg2hd5pRs814COmee26VtW:jqFeB8ER8CHPvlwUhHjg27O5exVY

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dzpplbbx.exe	9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dzpplbbx.exe	9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4716 set thread context of 1376	4716	9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1376	9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9.exe
1376	9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 1376	4716	9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9.exe	82
PID 4716 wrote to memory of 1376	4716	9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9.exe	82
PID 4716 wrote to memory of 1376	4716	9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9.exe	82
PID 4716 wrote to memory of 1376	4716	9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9.exe	82
PID 4716 wrote to memory of 1376	4716	9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9.exe	82
PID 1376 wrote to memory of 2540	1376	9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9.exe	30
PID 1376 wrote to memory of 2540	1376	9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9.exe	30
PID 1376 wrote to memory of 2540	1376	9176f3dc694ccbd4df2921eeedbc58cb461a8e9ee30a476892f1441ac29022e9.exe	30

memory/1376-136-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1376-138-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1376-140-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4716-132-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4716-133-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/4716-134-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4716-139-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download