ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2

Analysis

max time kernel
45s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 02:22

Target

ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2.exe
Size

55KB
MD5

db704a17e1d0117b6eab6f6a5149424c
SHA1

91497746ee986c475b718bf60e5da9f11ccd960f
SHA256

ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2
SHA512

5cac2a2c4d610d1fa640cb5818db04d4e91a4cb0e47fd4075d8741c5eaf5490b595eec482c310a2298d101193429b3c1673948623f0ce3d92d3990525d35a24e
SSDEEP

1536:52WdKTLQEvCe4MKQ289vckXbjtZn2q5OX:gpbC82VojH2qk

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tytyd3od.exe	ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tytyd3od.exe	ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1340 set thread context of 1036	1340	ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1036	ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1036	1340	ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2.exe	27
PID 1340 wrote to memory of 1036	1340	ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2.exe	27
PID 1340 wrote to memory of 1036	1340	ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2.exe	27
PID 1340 wrote to memory of 1036	1340	ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2.exe	27
PID 1340 wrote to memory of 1036	1340	ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2.exe	27
PID 1340 wrote to memory of 1036	1340	ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2.exe	27
PID 1036 wrote to memory of 1288	1036	ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2.exe	16
PID 1036 wrote to memory of 1288	1036	ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2.exe	16
PID 1036 wrote to memory of 1288	1036	ff96e6a2ea0b24ad06e17b6a77f4b0a7d376bc89f4db0ff88aa41bd04e4f25a2.exe	16

memory/1036-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1036-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1036-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1288-63-0x00000000029D0000-0x00000000029D3000-memory.dmp

Filesize
12KB

Download
memory/1340-54-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/1340-55-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1340-56-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1340-57-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1340-61-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download