a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 19:57

Target

a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe
Size

65KB
MD5

64256d7aa5880bbd629df194e1d96b0f
SHA1

e55e2fd1f8cbe4cd74ac1f27dd830f614b463c3e
SHA256

a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6
SHA512

844404b0ced740eeea2d29655d96acd3f8bfbb6e4c740373be3d88920adcd10768909031c6ed2eb4945d49fc6103f18d915d684a09be36c52a92a17922c27d84
SSDEEP

1536:U+dvQFZ7Fxqlq+MLMRqyBpB+j5eBYGp4mh:U+dv2ZFxqMFyBpglYvim

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tit6t7yd.exe	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tit6t7yd.exe	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 988	2032	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
988	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 988	2032	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe	27
PID 2032 wrote to memory of 988	2032	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe	27
PID 2032 wrote to memory of 988	2032	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe	27
PID 2032 wrote to memory of 988	2032	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe	27
PID 2032 wrote to memory of 988	2032	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe	27
PID 2032 wrote to memory of 988	2032	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe	27
PID 988 wrote to memory of 1368	988	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe	8
PID 988 wrote to memory of 1368	988	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe	8
PID 988 wrote to memory of 1368	988	a7b5f84ee72266be6d0dc98b758fb0930f84a51bdb2a575b8b3c9049bd1a3ae6.exe	8

memory/988-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/988-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/988-64-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1368-62-0x0000000002590000-0x0000000002593000-memory.dmp

Filesize
12KB

Download
memory/2032-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2032-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2032-56-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2032-60-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download