bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 18:34

Target

bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f.exe
Size

72KB
MD5

b0cf9d464427cfaf3a622b1aacd4bf49
SHA1

69830cbfe44030327a0fc40862519de3cfda5235
SHA256

bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f
SHA512

ed3543d077573f942b08ff3736686331ecb1105b2e80433e678878c153bc4550e978fe1c645fd8516acdd5e8e71d11b5ee4f03122c1b17f9d12a38eeead718b6
SSDEEP

1536:xqM5qoTm0GUPMWLpbQ/UTO7EkrE6tsSRXT/DZ:goTm3UrccDcnZ

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4o85oty.exe	bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4o85oty.exe	bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 816	1032	bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
816	bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 816	1032	bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f.exe	28
PID 1032 wrote to memory of 816	1032	bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f.exe	28
PID 1032 wrote to memory of 816	1032	bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f.exe	28
PID 1032 wrote to memory of 816	1032	bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f.exe	28
PID 1032 wrote to memory of 816	1032	bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f.exe	28
PID 1032 wrote to memory of 816	1032	bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f.exe	28
PID 816 wrote to memory of 1232	816	bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f.exe	13
PID 816 wrote to memory of 1232	816	bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f.exe	13
PID 816 wrote to memory of 1232	816	bd5b27aa14e250461262e66de57be41f2e84a26e13cce30167157fb19a858b7f.exe	13

memory/816-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/816-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/816-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1032-54-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1032-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1032-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1032-57-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1032-61-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1232-63-0x0000000002120000-0x0000000002123000-memory.dmp

Filesize
12KB

Download