d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d

Analysis

max time kernel
224s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 21:30

Target

d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d.exe
Size

41KB
MD5

c97bdb4b62f9a3723b34b6abc159471f
SHA1

52eb902ce129ddf3c70077caafbfa2a40d51d23d
SHA256

d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d
SHA512

e9dbf50c9177d270a7b6155d803e70be1f7ab730a6b2faca47d666085bfa4b9f399cc1bb5fd02e5b53a9dc8bd51d1b8ebe257834cad29d1a6f480b6b2aebe410
SSDEEP

768:8a2U2mvgrF3lAA34VXoJ87qbIGbMB+zIXX+P+IlX0juCzuKC/v:N2U2LeowhGbMKkjuCzuKC/

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uuaukapfuk.exe	d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uuaukapfuk.exe	d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 468 set thread context of 1440	468	d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1440	d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 1440	468	d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d.exe	28
PID 468 wrote to memory of 1440	468	d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d.exe	28
PID 468 wrote to memory of 1440	468	d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d.exe	28
PID 468 wrote to memory of 1440	468	d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d.exe	28
PID 468 wrote to memory of 1440	468	d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d.exe	28
PID 468 wrote to memory of 1440	468	d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d.exe	28
PID 1440 wrote to memory of 1272	1440	d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d.exe	12
PID 1440 wrote to memory of 1272	1440	d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d.exe	12
PID 1440 wrote to memory of 1272	1440	d7ac880cc5d39f59ad4b5c5af292a4238ee35e1b24b0cb243798b3683712c23d.exe	12

memory/468-54-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/468-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/468-58-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1272-61-0x0000000002A50000-0x0000000002A53000-memory.dmp

Filesize
12KB

Download
memory/1440-56-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1440-57-0x0000000000401840-mapping.dmp

Download
memory/1440-60-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1440-63-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download