a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2

Analysis

max time kernel
60s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 16:17

Target

a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2.exe
Size

72KB
MD5

72d4994cf22cee131497584cfadc8e2f
SHA1

17f24acc521c4355c0b33874c9bdbb5a2178dfe4
SHA256

a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2
SHA512

7eb9d3120c7151b5a5eaac7a48d44e5fa247362d00aedcfe283eed2f22d5db146effb1564d3a756c7f6452312f08ff4c44924f3ca6952fd0273d2308d8324562
SSDEEP

1536:F4n51IGUPMWLpbQ/UTO7pcXqXRQ7NkPE:8rUrcc/XgG7ec

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eojjo1ytty2.exe	a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eojjo1ytty2.exe	a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1072 set thread context of 1396	1072	a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1396	a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 1396	1072	a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2.exe	27
PID 1072 wrote to memory of 1396	1072	a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2.exe	27
PID 1072 wrote to memory of 1396	1072	a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2.exe	27
PID 1072 wrote to memory of 1396	1072	a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2.exe	27
PID 1072 wrote to memory of 1396	1072	a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2.exe	27
PID 1072 wrote to memory of 1396	1072	a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2.exe	27
PID 1396 wrote to memory of 1388	1396	a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2.exe	14
PID 1396 wrote to memory of 1388	1396	a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2.exe	14
PID 1396 wrote to memory of 1388	1396	a2ef45d61bb75ff6c7570b9048985137b5c1148a99bc9666d1ceb1e10ba704a2.exe	14

memory/1072-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1072-54-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1072-56-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1072-60-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1072-61-0x0000000000540000-0x000000000055D000-memory.dmp

Filesize
116KB

Download
memory/1388-63-0x0000000002A60000-0x0000000002A63000-memory.dmp

Filesize
12KB

Download
memory/1396-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1396-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1396-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download