97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55

Analysis

max time kernel
36s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 16:53

Target

97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55.exe
Size

86KB
MD5

c1f2d71fdf6003290c89cb6c0d2aff3c
SHA1

0e2f00619b422ad732d9c38670bcd68151ea384b
SHA256

97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55
SHA512

7103268ee4810eec60cfbd078a3b89c1a22bd7b96d77463740dec8c9748f112690f081e35a891cf0d3d7fbf94d05df57c3582dd08ac3fcd12536978ffe7e559d
SSDEEP

768:8/IwI4gTtUReg/UXssPzfQE6rrDNswNX9pQUnbmhGOOOOOOOaHaJB4VQgvBAfBKb:bd4gTtUMgQzfWrrDNhLGKYBuOw

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y9joj7ot6t.exe	97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y9joj7ot6t.exe	97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 964 set thread context of 1748	964	97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1748	97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 1748	964	97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55.exe	26
PID 964 wrote to memory of 1748	964	97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55.exe	26
PID 964 wrote to memory of 1748	964	97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55.exe	26
PID 964 wrote to memory of 1748	964	97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55.exe	26
PID 964 wrote to memory of 1748	964	97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55.exe	26
PID 964 wrote to memory of 1748	964	97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55.exe	26
PID 1748 wrote to memory of 1412	1748	97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55.exe	15
PID 1748 wrote to memory of 1412	1748	97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55.exe	15
PID 1748 wrote to memory of 1412	1748	97741ec48fe4e6e34266822927f48f2a0b38a0146ebc61e5777dd4d26378ba55.exe	15

memory/964-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/964-55-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/964-56-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/964-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/964-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1412-63-0x00000000025B0000-0x00000000025B3000-memory.dmp

Filesize
12KB

Download
memory/1748-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1748-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1748-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download