b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 14:44

Target

b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe
Size

62KB
MD5

12e2dc2b1747112a040f264d6c86eff4
SHA1

9dc85cb44f7039348e8599331f39d21d0f2eb772
SHA256

b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e
SHA512

4216ef4df926a17e411097e1b7c7a633fc458ad4da6a2ea6ca8974534cd022df685038ee0309c14fdd0c52a81a212f50ecf21449326a00f01e5648cf3d3a2135
SSDEEP

1536:V76iwKMDFwHmWd/+4vW2/dCXLk0YTtQkWn9Wf1i2vS:VzEwHmqW4vW2/+I0vH9cit

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\u9q1miiduu.exe	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\u9q1miiduu.exe	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 460 set thread context of 2304	460	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2304	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe
2304	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 2304	460	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	80
PID 460 wrote to memory of 2304	460	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	80
PID 460 wrote to memory of 2304	460	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	80
PID 460 wrote to memory of 2304	460	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	80
PID 460 wrote to memory of 2304	460	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	80
PID 2304 wrote to memory of 2132	2304	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	45
PID 2304 wrote to memory of 2132	2304	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	45
PID 2304 wrote to memory of 2132	2304	b6243ebd76da49cace8869f5117cba45791ca31b61c1f7ab615832c303e8998e.exe	45

memory/460-132-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/460-133-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/460-134-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/460-135-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/460-140-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2304-137-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2304-139-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2304-141-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download