cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6

Analysis

max time kernel
33s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 04:30

Target

cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6.exe
Size

82KB
MD5

54cd9dc6b32cc97eca98b010e427c00b
SHA1

aceab27311bf457b6b923c41a50c228215f0bb21
SHA256

cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6
SHA512

b4d36c796d71764f5212858c0fff92a76b36035c6d079dab62f24877b57746a2a6a6a485cd87e981e282a2d8c701f13e115b1f5a63f112d1eb9bbd3d84c12c0d
SSDEEP

1536:Xd8XA7fzqULshi5qJubQbWjjp+Cn6NMbiVq1CV:N8XA7Lqk5qJubEi9+Cn6N/Vq1CV

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jyeoetjy.exe	cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jyeoetjy.exe	cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1452 set thread context of 664	1452	cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
664	cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 664	1452	cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6.exe	28
PID 1452 wrote to memory of 664	1452	cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6.exe	28
PID 1452 wrote to memory of 664	1452	cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6.exe	28
PID 1452 wrote to memory of 664	1452	cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6.exe	28
PID 1452 wrote to memory of 664	1452	cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6.exe	28
PID 1452 wrote to memory of 664	1452	cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6.exe	28
PID 664 wrote to memory of 1296	664	cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6.exe	15
PID 664 wrote to memory of 1296	664	cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6.exe	15
PID 664 wrote to memory of 1296	664	cf37675c0896d83e33be0ae50d31f37bf7dba089596f6332f7522ab1f3eae3e6.exe	15

memory/664-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/664-60-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/664-64-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1296-62-0x0000000002660000-0x0000000002663000-memory.dmp

Filesize
12KB

Download
memory/1452-55-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1452-54-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1452-56-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1452-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download