5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52

Analysis

max time kernel
18s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 04:45

Target

5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52.exe
Size

72KB
MD5

13de0375b8fffad314912cd56fe04d96
SHA1

7e416e99d28e92c2d00dd86d4886287ec9fe9495
SHA256

5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52
SHA512

895fe986fb9e1ea81143d13308a993e42d86310a4ee18e8ca79abfe28958ceaf5b37700636f5ba00f8680a066d86f1457a36ba8a9e1f8f78fbd62130898f48b5
SSDEEP

768:FMYC5KmvbYdbf2QOGUTDMVPcQFZUdvbQ/fM5dX+9NTkbjyb64Zhti5lNBWIOJm/g:FMP5Dvb/GUPMWLpbQ/UTO7TkiU9OAA5

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ey4e90j3.exe	5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ey4e90j3.exe	5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 1348	2036	5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1348	5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1348	2036	5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52.exe	28
PID 2036 wrote to memory of 1348	2036	5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52.exe	28
PID 2036 wrote to memory of 1348	2036	5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52.exe	28
PID 2036 wrote to memory of 1348	2036	5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52.exe	28
PID 2036 wrote to memory of 1348	2036	5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52.exe	28
PID 2036 wrote to memory of 1348	2036	5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52.exe	28
PID 1348 wrote to memory of 1252	1348	5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52.exe	15
PID 1348 wrote to memory of 1252	1348	5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52.exe	15
PID 1348 wrote to memory of 1252	1348	5c2d926030ecade65176f69483d7686a1f4e51463caf62b15ee13f6b2bba5a52.exe	15

memory/1252-62-0x0000000002A80000-0x0000000002A83000-memory.dmp

Filesize
12KB

Download
memory/1348-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1348-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1348-64-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2036-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2036-54-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2036-56-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/2036-60-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download