b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050

Analysis

max time kernel
213s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 15:12

Target

b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050.exe
Size

72KB
MD5

ece168ba13872e9f3ca8366de59cad13
SHA1

4a9a685d3821699466e0e250d7f530948f9965dc
SHA256

b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050
SHA512

9303ba8b6c1f2c4c9c5a8cd13c278216d57223ce2f7cc23d2a5c3783531ddde565c65eb072de26e551afadeeb10836fd4c6da7d53c8a77b31a22589b65b9b621
SSDEEP

1536:IZR5M0GUPMWLpbQ/UTO7wCA3M4twLtJsABra:gmUrcc9vLt8LBr

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ufzpfukap.exe	b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ufzpfukap.exe	b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 1156	1488	b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1156	b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1156	1488	b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050.exe	28
PID 1488 wrote to memory of 1156	1488	b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050.exe	28
PID 1488 wrote to memory of 1156	1488	b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050.exe	28
PID 1488 wrote to memory of 1156	1488	b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050.exe	28
PID 1488 wrote to memory of 1156	1488	b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050.exe	28
PID 1488 wrote to memory of 1156	1488	b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050.exe	28
PID 1156 wrote to memory of 1216	1156	b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050.exe	17
PID 1156 wrote to memory of 1216	1156	b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050.exe	17
PID 1156 wrote to memory of 1216	1156	b0c3b9d092c17c7a5276037ddc548c9872c75985471c66269262e8bf32887050.exe	17

memory/1156-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1156-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1156-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1216-63-0x0000000002910000-0x0000000002913000-memory.dmp

Filesize
12KB

Download
memory/1488-54-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1488-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1488-56-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/1488-59-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1488-61-0x0000000001D60000-0x0000000001D7D000-memory.dmp

Filesize
116KB

Download