75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 03:06

Target

75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2.exe
Size

72KB
MD5

1be51149236303aa591e635b5b57f01c
SHA1

e73229ae1b495392471b022284bac4a105955359
SHA256

75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2
SHA512

7af0eeec113c5a5a92474f5aa1a42842621ea83e0a7417d8c376f3558f8498b1f0b691a836ebeeb80ab5830e462ef1b8f4f1acd577abe750d49bc72582c3c16d
SSDEEP

768:3MYC5xvbYdbf2QOGUTDMVPcQFZUdvbQ/fM5dX+9NTkbjyb64Zhti5lNBWIOJm/A5:3MP5xvb/GUPMWLpbQ/UTO7TkiU9OAA5

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\do7yyoydj.exe	75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\do7yyoydj.exe	75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1896 set thread context of 2032	1896	75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2032	75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2032	1896	75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2.exe	27
PID 1896 wrote to memory of 2032	1896	75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2.exe	27
PID 1896 wrote to memory of 2032	1896	75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2.exe	27
PID 1896 wrote to memory of 2032	1896	75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2.exe	27
PID 1896 wrote to memory of 2032	1896	75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2.exe	27
PID 1896 wrote to memory of 2032	1896	75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2.exe	27
PID 2032 wrote to memory of 1268	2032	75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2.exe	15
PID 2032 wrote to memory of 1268	2032	75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2.exe	15
PID 2032 wrote to memory of 1268	2032	75b9439d6b31aa4cb829b810e69e9341675d2a07e0d03ad6d10da7d6f7c18ac2.exe	15

memory/1268-63-0x0000000002220000-0x0000000002223000-memory.dmp

Filesize
12KB

Download
memory/1896-54-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1896-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1896-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1896-57-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1896-62-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2032-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2032-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2032-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download