7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05

Analysis

max time kernel
215s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 03:12

Target

7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe
Size

190KB
MD5

d805d969a859002181596ec1e7dd2feb
SHA1

bbebddac95bca878b1299f4d4e2c82aba0b8acc6
SHA256

7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05
SHA512

795c21470d5f4cc071e83410d57472409ea8e0bbc59d4b98d0333f3872f49c78eaf40ae7239f0ef07d03a8547f7a817ec444ec116d88ffdbeea0b35c25ad0674
SSDEEP

3072:q+fdo40V6a9Ng9QNUwGW0zW/u/vvK09JzvZYTSrxqWNxK:q+fHwK9Thy/qvmqx8

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvzGO4WEtsg.exe	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvzGO4WEtsg.exe	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 544 set thread context of 1472	544	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1472	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1472	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 1472	544	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe	28
PID 544 wrote to memory of 1472	544	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe	28
PID 544 wrote to memory of 1472	544	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe	28
PID 544 wrote to memory of 1472	544	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe	28
PID 544 wrote to memory of 1472	544	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe	28
PID 544 wrote to memory of 1472	544	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe	28
PID 544 wrote to memory of 1472	544	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe	28
PID 544 wrote to memory of 1472	544	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe	28
PID 544 wrote to memory of 1472	544	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe	28
PID 544 wrote to memory of 1472	544	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe	28
PID 1472 wrote to memory of 1504	1472	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe	29
PID 1472 wrote to memory of 1504	1472	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe	29
PID 1472 wrote to memory of 1504	1472	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe	29
PID 1472 wrote to memory of 1504	1472	7743711f0b83dba511ea6c042947ccbb24e97e277107acfad6620dd09e491d05.exe	29

memory/544-54-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/544-55-0x00000000026E0000-0x0000000002712000-memory.dmp

Filesize
200KB

Download
memory/544-61-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1472-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1472-57-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1472-58-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1472-59-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1472-62-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1472-63-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download