82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798

Analysis

max time kernel
39s
max time network
64s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 02:10

Target

82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798.exe
Size

65KB
MD5

a0b17e2e9b23d6ed2d0f03914ca36a48
SHA1

f34a9a8b8cc919d3e864acd2aeab4119bdcc698a
SHA256

82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798
SHA512

bdd7f9bc65c8cc52a8bb0c7c815428c0ff8531a4942d3f50c464ab466ee09011822deee5925ba80e42b3aeea29e7a27dab60296f18ce42998e0c95b4346a115d
SSDEEP

768:9TdCt5Z3k9wVfV7uqGdFfw/i8aNza6UWKAqx38QEBEMp+eAHrfSt:95Ct5Z30GflOvfkcUDxvESMp+NLfSt

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oydyjojt2.exe	82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oydyjojt2.exe	82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 1020	1400	82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1020	82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1020	1400	82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798.exe	27
PID 1400 wrote to memory of 1020	1400	82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798.exe	27
PID 1400 wrote to memory of 1020	1400	82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798.exe	27
PID 1400 wrote to memory of 1020	1400	82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798.exe	27
PID 1400 wrote to memory of 1020	1400	82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798.exe	27
PID 1400 wrote to memory of 1020	1400	82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798.exe	27
PID 1020 wrote to memory of 1216	1020	82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798.exe	11
PID 1020 wrote to memory of 1216	1020	82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798.exe	11
PID 1020 wrote to memory of 1216	1020	82f099f9b079225f645dc52566c6d70a19a39569cfdb25d59f0fd36ceb69a798.exe	11

memory/1020-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1020-58-0x0000000000401840-mapping.dmp

Download
memory/1020-60-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1020-64-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1216-62-0x0000000001E10000-0x0000000001E13000-memory.dmp

Filesize
12KB

Download
memory/1400-54-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1400-56-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1400-55-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1400-61-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download