9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950

Analysis

max time kernel
35s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 12:52

Target

9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950.exe
Size

42KB
MD5

dd3a62fb9fb46d256a0274ed1cd7353a
SHA1

d192458bc926b65b2aa1bef40d7bcc5d5a63868a
SHA256

9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950
SHA512

2583e300eaefc0897c2f25b7ba190070e3a14dbb5c8fa42291db7b7b89efce8d4a727d241a3948cdf886cc5be0d0c5a062d21fb1df8b4c13f5f8c7867d003d70
SSDEEP

768:Re2UDmvgrF3lAA34VXoJ87fbI2bZB+zIXX+sN/nybAc0Grp7AzsISNv78I:g2UDLeow02bZflyb106pLIrI

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iooddjotyy.exe	9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iooddjotyy.exe	9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1988 set thread context of 480	1988	9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
480	9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 480	1988	9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950.exe	28
PID 1988 wrote to memory of 480	1988	9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950.exe	28
PID 1988 wrote to memory of 480	1988	9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950.exe	28
PID 1988 wrote to memory of 480	1988	9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950.exe	28
PID 1988 wrote to memory of 480	1988	9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950.exe	28
PID 1988 wrote to memory of 480	1988	9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950.exe	28
PID 480 wrote to memory of 1208	480	9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950.exe	11
PID 480 wrote to memory of 1208	480	9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950.exe	11
PID 480 wrote to memory of 1208	480	9102fd96bbefd2c892c29c88315e5e1eca2535ba564fc28197c8c284f168d950.exe	11

memory/480-56-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/480-59-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/480-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1208-60-0x0000000002200000-0x0000000002203000-memory.dmp

Filesize
12KB

Download
memory/1988-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1988-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download