82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 02:11

Target

82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a.exe
Size

63KB
MD5

f764b5bf21a49c265e52e6446e1c256c
SHA1

d5a1d89249b3b750df0c3ed748ff0c3dc4a23cd1
SHA256

82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a
SHA512

3e8ab86640ae9469b332260a0151f2811228d559b8b6a57b3540cbd3d4862d13a8327d3381f9a0d481db843cb7390bb87d33b0bd052a17e1df92e1d7d2fc4150
SSDEEP

1536:pdDli9bG/O8lCqarm2euXqdddddddddddddddddddddddddddddddddddddddddQ:pZg9bGW8lTvQXNRxm4Vh

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\doj5jdodo.exe	82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\doj5jdodo.exe	82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 620 set thread context of 1288	620	82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1288	82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1288	620	82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a.exe	27
PID 620 wrote to memory of 1288	620	82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a.exe	27
PID 620 wrote to memory of 1288	620	82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a.exe	27
PID 620 wrote to memory of 1288	620	82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a.exe	27
PID 620 wrote to memory of 1288	620	82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a.exe	27
PID 620 wrote to memory of 1288	620	82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a.exe	27
PID 1288 wrote to memory of 1192	1288	82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a.exe	20
PID 1288 wrote to memory of 1192	1288	82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a.exe	20
PID 1288 wrote to memory of 1192	1288	82b86f8b4dab67e97a13a4d8c530b18b9ddbbe50bfece8f59e0da460c21f987a.exe	20

memory/620-55-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/620-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/620-57-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/620-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1192-63-0x0000000002A30000-0x0000000002A33000-memory.dmp

Filesize
12KB

Download
memory/1288-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1288-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1288-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download