ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 10:40

Target

ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e.exe
Size

75KB
MD5

8d0af3fa9103cb42669ccd8993e8bbf6
SHA1

c2d59f5b207564b7a44bbb42fb0fc0368db9cf86
SHA256

ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e
SHA512

0c4f67c81a89bfbfb4bd75876156490112e8155850f68584059933da260fd3e0edd281506f8c13a18ba71a17591054b51f3536bf395be8edce405b92d8a6e35c
SSDEEP

768:ZqvGPZwRDCaI3lhjtDw/XZd9KbjobhSE4qUK/YULko45Hvz/hWhozh59UImtt391:Zq4ZwtCVwvNKH2h8qUWFudX9UvH1

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jojt6td7.exe	ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jojt6td7.exe	ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1464 set thread context of 1116	1464	ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1116	ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1116	1464	ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e.exe	27
PID 1464 wrote to memory of 1116	1464	ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e.exe	27
PID 1464 wrote to memory of 1116	1464	ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e.exe	27
PID 1464 wrote to memory of 1116	1464	ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e.exe	27
PID 1464 wrote to memory of 1116	1464	ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e.exe	27
PID 1464 wrote to memory of 1116	1464	ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e.exe	27
PID 1116 wrote to memory of 1392	1116	ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e.exe	9
PID 1116 wrote to memory of 1392	1116	ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e.exe	9
PID 1116 wrote to memory of 1392	1116	ffb61109dc32a28555afda705d842e688754147728a5a9f8454777296645537e.exe	9

memory/1116-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1116-60-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1116-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1392-63-0x0000000002A80000-0x0000000002A83000-memory.dmp

Filesize
12KB

Download
memory/1464-55-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1464-54-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1464-56-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1464-62-0x0000000000420000-0x000000000043E000-memory.dmp

Filesize
120KB

Download
memory/1464-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download