5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 04:07

Target

5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad.exe
Size

75KB
MD5

23658cea3897e7c3eeb9843c083def1e
SHA1

ad80004d0e60038198d9686444b73102d4c784b7
SHA256

5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad
SHA512

0a597ea59e8fd3e890ea6a6983f08513bac6782011407cb49a45cc00d32e18e558133f7cf1aee60c7d93e47dc94695e419dc8b69a17ba46b38a24852935bca49
SSDEEP

768:YD39Hoa80i3JxRwRDCaI3lhjtDw/XZd9KbjobhB4Y2qYojopk6m+v:YD39Hoae3JxRwtCVwvNKH2hBrV6V

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y7tydjeot.exe	5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y7tydjeot.exe	5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1416 set thread context of 1100	1416	5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1100	5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1100	1416	5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad.exe	26
PID 1416 wrote to memory of 1100	1416	5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad.exe	26
PID 1416 wrote to memory of 1100	1416	5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad.exe	26
PID 1416 wrote to memory of 1100	1416	5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad.exe	26
PID 1416 wrote to memory of 1100	1416	5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad.exe	26
PID 1416 wrote to memory of 1100	1416	5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad.exe	26
PID 1100 wrote to memory of 1248	1100	5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad.exe	14
PID 1100 wrote to memory of 1248	1100	5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad.exe	14
PID 1100 wrote to memory of 1248	1100	5e6c8d96b4f6ce8a62fba238545175a9d0661bdf3c9074c65d1fa7e0cd1eedad.exe	14

memory/1100-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1100-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1100-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1248-63-0x0000000002690000-0x0000000002693000-memory.dmp

Filesize
12KB

Download
memory/1416-54-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1416-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1416-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1416-57-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/1416-62-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download