d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 12:23

Target

d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31.exe
Size

63KB
MD5

590b107fbb6228f2472af876b6146956
SHA1

4ae5fc38ccef3c3eccf52c6c6797ab1a17d3974b
SHA256

d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31
SHA512

bf5a2f36a6f6eeaacd486290b0310bd4c427b2435de6e67c6e28cf4593d90fdff69949563aa98207ee287498e12184847b86feee94b5ee199b4c8d0c25ac6ef3
SSDEEP

1536:FDigG6JxCqarm2euXqddddddddddddddddddddddddddddddddddddddddddddds:FegGITvQXNx+m3NJ

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ydjytdt9j3.exe	d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ydjytdt9j3.exe	d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1760 set thread context of 1648	1760	d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1648	d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1648	1760	d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31.exe	28
PID 1760 wrote to memory of 1648	1760	d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31.exe	28
PID 1760 wrote to memory of 1648	1760	d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31.exe	28
PID 1760 wrote to memory of 1648	1760	d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31.exe	28
PID 1760 wrote to memory of 1648	1760	d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31.exe	28
PID 1760 wrote to memory of 1648	1760	d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31.exe	28
PID 1648 wrote to memory of 1260	1648	d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31.exe	18
PID 1648 wrote to memory of 1260	1648	d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31.exe	18
PID 1648 wrote to memory of 1260	1648	d544d7fde0a1ba6199f82ac8ae917f0fca39d8ce158dc50ec41cbe2390a81f31.exe	18

memory/1260-64-0x0000000002A60000-0x0000000002A63000-memory.dmp

Filesize
12KB

Download
memory/1648-59-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1648-60-0x0000000000401840-mapping.dmp

Download
memory/1648-63-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1648-66-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1760-56-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1760-55-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1760-57-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1760-58-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1760-62-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download