38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb

Analysis

max time kernel
26s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 00:11

Target

38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb.exe
Size

83KB
MD5

3cc40d5c0d01fc4fde3331d9695b1270
SHA1

14a7917535a6efb9838b7b1213f2bfef6f3967e2
SHA256

38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb
SHA512

86c145899ac0d9d91bd60207cc886d6936347abc3c1c219ce25d0c3a7e2f19ff3f1bff736b8052df96c11049b16f725cd015b89a77d0853136d4a7a03ef29699
SSDEEP

768:5EgVAd0D3H+xi6KzgZUwcshOXBzqAyubQbWjejWsCo6csR6TsdMceFHdebG:ad83H9zqULshi5qJubQbWjj9ATsdQE

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ot2o7yeyjo.exe	38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ot2o7yeyjo.exe	38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 304 set thread context of 2008	304	38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2008	38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 304 wrote to memory of 2008	304	38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb.exe	27
PID 304 wrote to memory of 2008	304	38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb.exe	27
PID 304 wrote to memory of 2008	304	38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb.exe	27
PID 304 wrote to memory of 2008	304	38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb.exe	27
PID 304 wrote to memory of 2008	304	38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb.exe	27
PID 304 wrote to memory of 2008	304	38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb.exe	27
PID 2008 wrote to memory of 1420	2008	38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb.exe	9
PID 2008 wrote to memory of 1420	2008	38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb.exe	9
PID 2008 wrote to memory of 1420	2008	38be5f1da20384fe105cb80705ebcc9b396b4dfb9301362d238c0f4d93b384eb.exe	9

memory/304-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/304-54-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/304-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/304-57-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/304-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1420-63-0x0000000002280000-0x0000000002283000-memory.dmp

Filesize
12KB

Download
memory/2008-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2008-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2008-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download