a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 19:59

Target

a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d.exe
Size

75KB
MD5

71c8841bc40cc29104d20f580b74dd12
SHA1

2a5ebc3d931f8d184bb68ac01594127f6e9a3609
SHA256

a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d
SHA512

9d2ab448f5106f52895af1b168571c3478394feda6dc91d34119627fc73b91268e4cfab4fbe1172701478af01c37e3f07cd5999338b992f2afc10a1200e6b5ec
SSDEEP

1536:zYxsxRI6mwtCVwvNKH2h7b3wMjc7Ti+GMysDW:zYxsrIitg7WhHwx7TtG5sD

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yjyjyj8j4.exe	a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yjyjyj8j4.exe	a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1552 set thread context of 1760	1552	a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1760	a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1760	1552	a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d.exe	26
PID 1552 wrote to memory of 1760	1552	a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d.exe	26
PID 1552 wrote to memory of 1760	1552	a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d.exe	26
PID 1552 wrote to memory of 1760	1552	a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d.exe	26
PID 1552 wrote to memory of 1760	1552	a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d.exe	26
PID 1552 wrote to memory of 1760	1552	a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d.exe	26
PID 1760 wrote to memory of 1220	1760	a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d.exe	8
PID 1760 wrote to memory of 1220	1760	a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d.exe	8
PID 1760 wrote to memory of 1220	1760	a769137f38445962b2d7c7e6b979227378d2218839ed031ed7b57d66e25bce5d.exe	8

memory/1220-62-0x0000000002A40000-0x0000000002A43000-memory.dmp

Filesize
12KB

Download
memory/1552-54-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1552-55-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1552-56-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/1552-59-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1760-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1760-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1760-64-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download