b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 14:44 UTC

Target

b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe
Size

62KB
MD5

12e2dc2b1747112a040f264d6c86eff4
SHA1

9dc85cb44f7039348e8599331f39d21d0f2eb772
SHA256

b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e
SHA512

4216ef4df926a17e411097e1b7c7a633fc458ad4da6a2ea6ca8974534cd022df685038ee0309c14fdd0c52a81a212f50ecf21449326a00f01e5648cf3d3a2135
SSDEEP

1536:V76iwKMDFwHmWd/+4vW2/dCXLk0YTtQkWn9Wf1i2vS:VzEwHmqW4vW2/+I0vH9cit

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1jotoy7.exe	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1jotoy7.exe	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1584 set thread context of 900	1584	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
900	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 900	1584	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	28
PID 1584 wrote to memory of 900	1584	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	28
PID 1584 wrote to memory of 900	1584	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	28
PID 1584 wrote to memory of 900	1584	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	28
PID 1584 wrote to memory of 900	1584	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	28
PID 1584 wrote to memory of 900	1584	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	28
PID 900 wrote to memory of 1256	900	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	21
PID 900 wrote to memory of 1256	900	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	21
PID 900 wrote to memory of 1256	900	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	21

memory/900-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/900-63-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/900-66-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1256-64-0x00000000021A0000-0x00000000021A3000-memory.dmp

Filesize
12KB

Download
memory/1584-54-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1584-55-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1584-56-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1584-57-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1584-61-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1584-62-0x0000000001DA0000-0x0000000001DBB000-memory.dmp

Filesize
108KB

Download