a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10

Analysis

max time kernel
44s
max time network
62s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 16:06

Target

a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10.exe
Size

66KB
MD5

899db83ef68dc0f243bee936b9254740
SHA1

9c47d641ae9e507266cc47940257d9d3bb254ebe
SHA256

a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10
SHA512

0e3428900364ffdb6787d05daee2069baa08c37beb93c096046297a4ec6ca357c729671ab724cbfccc091d352e933b62974bf188bc0df9e20b882c5b2373f61a
SSDEEP

1536:D/dvQFZ7Fxqlq+MLMRqyBpB+j5eBYGp4mhLN:D/dv2ZFxqMFyBpglYvim/

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tdtd7ddjo.exe	a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tdtd7ddjo.exe	a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 960 set thread context of 1968	960	a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10.exe	20

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1968	a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1968	960	a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10.exe	20
PID 960 wrote to memory of 1968	960	a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10.exe	20
PID 960 wrote to memory of 1968	960	a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10.exe	20
PID 960 wrote to memory of 1968	960	a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10.exe	20
PID 960 wrote to memory of 1968	960	a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10.exe	20
PID 960 wrote to memory of 1968	960	a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10.exe	20
PID 1968 wrote to memory of 1220	1968	a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10.exe	12
PID 1968 wrote to memory of 1220	1968	a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10.exe	12
PID 1968 wrote to memory of 1220	1968	a56b8a82068f9317a8664259b14bbd785af8142aeee499e3497b420975219d10.exe	12

memory/960-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/960-61-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/960-56-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/960-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1220-62-0x0000000001DF0000-0x0000000001DF3000-memory.dmp

Filesize
12KB

Download
memory/1968-60-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1968-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1968-64-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download