caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 13:08

Target

caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489.exe
Size

56KB
MD5

61ef73d1243543cca19a61346ec599cb
SHA1

20d23ee2210cc15450d9fbbb2a07e4a7b1cb909e
SHA256

caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489
SHA512

41a7e2a03e75815c79b36532704d38875f300f667081078c095be4b6367e4b3111c90395dd505ad47fc97a29a5b21b836493282e68eec12f73badc9ad4e38c39
SSDEEP

768:T3Nl57q8uO2gdN6r9iXW9ofVj37lsFPWu02Z8cI2aTiW+XaF:TlGE2wjm9oF37lUnZK+qF

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tdtd7do7o.exe	caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tdtd7do7o.exe	caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 940	2032	caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
940	caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 940	2032	caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489.exe	27
PID 2032 wrote to memory of 940	2032	caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489.exe	27
PID 2032 wrote to memory of 940	2032	caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489.exe	27
PID 2032 wrote to memory of 940	2032	caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489.exe	27
PID 2032 wrote to memory of 940	2032	caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489.exe	27
PID 2032 wrote to memory of 940	2032	caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489.exe	27
PID 940 wrote to memory of 1368	940	caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489.exe	16
PID 940 wrote to memory of 1368	940	caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489.exe	16
PID 940 wrote to memory of 1368	940	caa6a0987c5471f7d333b542a84fb98e42f69cb8c7a60dfd3e6ed133743e0489.exe	16

memory/940-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/940-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/940-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1368-63-0x0000000002590000-0x0000000002593000-memory.dmp

Filesize
12KB

Download
memory/2032-55-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/2032-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2032-57-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2032-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download