b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 19:21

Target

b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb.exe
Size

72KB
MD5

c434619271f4a14799a23ad9cd404589
SHA1

70426201b4d5e7dfb75819f4c1771fe0a3003168
SHA256

b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb
SHA512

e67df5084e00be16c0deb8f75ce4a601f540306375a4fac7a45320b776d917fc523fcefd87efa4eb1f901add89dba796bdc994e9a2e179609cc211b1b9d664a7
SSDEEP

1536:8E5OdGUPMWLpbQ/UTO77gInaG/l8sdGZJ6:nUrccL8//Jgn

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\todt9jtjyyt.exe	b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\todt9jtjyyt.exe	b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1700 set thread context of 1264	1700	b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1264	b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1264	1700	b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb.exe	28
PID 1700 wrote to memory of 1264	1700	b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb.exe	28
PID 1700 wrote to memory of 1264	1700	b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb.exe	28
PID 1700 wrote to memory of 1264	1700	b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb.exe	28
PID 1700 wrote to memory of 1264	1700	b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb.exe	28
PID 1700 wrote to memory of 1264	1700	b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb.exe	28
PID 1264 wrote to memory of 1208	1264	b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb.exe	4
PID 1264 wrote to memory of 1208	1264	b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb.exe	4
PID 1264 wrote to memory of 1208	1264	b0fea1b8cb58fea9dc7a794035186f552d1fd4918ff6b338b2c554e351a25fdb.exe	4

memory/1208-63-0x0000000002600000-0x0000000002603000-memory.dmp

Filesize
12KB

Download
memory/1264-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1264-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1264-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1700-54-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1700-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1700-56-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1700-60-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1700-61-0x0000000001D60000-0x0000000001D7D000-memory.dmp

Filesize
116KB

Download