5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 04:52

Target

5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624.exe
Size

54KB
MD5

1145f2964d2e95cd0302679a6b6021f4
SHA1

2abf0f935d22495849279f09ca671a8c2f42cb6b
SHA256

5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624
SHA512

e4cb44156c60a6386d52ae80f7b7e47e470e201df2a3a7a194a4784fec6e70539a48fd48b5f9cf6acc2131ec03741c51233f08e20c3d61b96a6f05d9d4b1656e
SSDEEP

768:OuuYRNj6vO5gl69z8bmi6m8+/U0tePEaQVNFi1WVAbceGkgeg0eY:dVfGl69z8t6m8LQVNhOpngu

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jo96eoeo8.exe	5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jo96eoeo8.exe	5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1428 set thread context of 1348	1428	5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1348	5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1348	1428	5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624.exe	26
PID 1428 wrote to memory of 1348	1428	5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624.exe	26
PID 1428 wrote to memory of 1348	1428	5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624.exe	26
PID 1428 wrote to memory of 1348	1428	5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624.exe	26
PID 1428 wrote to memory of 1348	1428	5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624.exe	26
PID 1428 wrote to memory of 1348	1428	5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624.exe	26
PID 1348 wrote to memory of 1232	1348	5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624.exe	10
PID 1348 wrote to memory of 1232	1348	5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624.exe	10
PID 1348 wrote to memory of 1232	1348	5a134efe1338ea611a1971aee45d708e3197c12b20ac5bdcc2f4f5ec7d4a4624.exe	10

memory/1232-63-0x0000000001DF0000-0x0000000001DF3000-memory.dmp

Filesize
12KB

Download
memory/1348-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1348-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1348-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1428-54-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1428-55-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/1428-56-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1428-57-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1428-60-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download