c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0

Analysis

max time kernel
45s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 18:19

Target

c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0.exe
Size

64KB
MD5

4a98f69ab063bc5b208d311689f41e31
SHA1

d3dc2de2bb26872341f0d7cfd0af2317ae249b94
SHA256

c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0
SHA512

6bab77dd4adf8feecfc47a9b935f83db5874e9b85bf55c98a54816e5109ce99b62e906b26652c89e8a43a368bbda1958939d4cd56392733a9c527cda209d9ae8
SSDEEP

1536:ODU0vMMzApDNGZj5xl0A1fpppppppppppppbDHs2jXww:mXvM3pcFD6MfpppppppppppppbLs2jX/

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ydjdotoy7ty.exe	c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ydjdotoy7ty.exe	c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1340 set thread context of 844	1340	c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
844	c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 844	1340	c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0.exe	27
PID 1340 wrote to memory of 844	1340	c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0.exe	27
PID 1340 wrote to memory of 844	1340	c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0.exe	27
PID 1340 wrote to memory of 844	1340	c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0.exe	27
PID 1340 wrote to memory of 844	1340	c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0.exe	27
PID 1340 wrote to memory of 844	1340	c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0.exe	27
PID 844 wrote to memory of 1288	844	c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0.exe	15
PID 844 wrote to memory of 1288	844	c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0.exe	15
PID 844 wrote to memory of 1288	844	c0e9bdf08fa69a832ee03103faf44e45a7a30434f21b36d68810ff0294001fa0.exe	15

memory/844-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/844-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/844-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1288-63-0x00000000029D0000-0x00000000029D3000-memory.dmp

Filesize
12KB

Download
memory/1340-54-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1340-55-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1340-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1340-57-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1340-61-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download