c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 18:58

Target

c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f.exe
Size

61KB
MD5

42edb6772f3bc8d9f6c61d3f22b76909
SHA1

8c45a8b66fec61fba370444ec64aa27043515f26
SHA256

c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f
SHA512

c8fb3f1f59c13d705a78da66da3c8f1f77130ab064cf895ef8a6b996b7a6f69cc73025298f6c30b6327caa4ae1cbc49d55092d2730d30ce2b7d58afe32a60eb9
SSDEEP

1536:fUXWBU5rdLvSDzxAMdQTCcHqcN4pHYeYKH:uW65lv4A1CcJ49Ye1

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3o96dod.exe	c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3o96dod.exe	c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1500 set thread context of 1404	1500	c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1404	c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1404	1500	c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f.exe	27
PID 1500 wrote to memory of 1404	1500	c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f.exe	27
PID 1500 wrote to memory of 1404	1500	c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f.exe	27
PID 1500 wrote to memory of 1404	1500	c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f.exe	27
PID 1500 wrote to memory of 1404	1500	c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f.exe	27
PID 1500 wrote to memory of 1404	1500	c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f.exe	27
PID 1404 wrote to memory of 1344	1404	c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f.exe	9
PID 1404 wrote to memory of 1344	1404	c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f.exe	9
PID 1404 wrote to memory of 1344	1404	c8f0f877fb89ad8fc8b40ac1895666c323a91075389a223b7a4c0760942e923f.exe	9

memory/1344-62-0x0000000002740000-0x0000000002743000-memory.dmp

Filesize
12KB

Download
memory/1404-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1404-58-0x0000000000401840-mapping.dmp

Download
memory/1404-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1404-64-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1500-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1500-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1500-56-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1500-60-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download