ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 12:43

Target

ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503.exe
Size

42KB
MD5

45a572f07b2556c6a84336f040fcc8b7
SHA1

0316f0fa04e244d9fe67426ef4e4e950cb8a518b
SHA256

ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503
SHA512

7619264421c061004c50cd5ada8a23908f681b889bf36702d788669cecf8a29f81c026d988e69d47352ff4546e04cb05cbef59bc49d6d548ab61f9d386511e03
SSDEEP

768:LEWatJ6I2hXzRls84E1R3gZYE4ubb+zIXX+pCl8VMFYLscnFK3T:oWatJ6jhXzfs84k3g3b38VqYVF2T

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tojoy2t8dj.exe	ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tojoy2t8dj.exe	ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1184 set thread context of 2040	1184	ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2040	ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2040	1184	ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503.exe	27
PID 1184 wrote to memory of 2040	1184	ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503.exe	27
PID 1184 wrote to memory of 2040	1184	ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503.exe	27
PID 1184 wrote to memory of 2040	1184	ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503.exe	27
PID 1184 wrote to memory of 2040	1184	ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503.exe	27
PID 1184 wrote to memory of 2040	1184	ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503.exe	27
PID 2040 wrote to memory of 1284	2040	ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503.exe	19
PID 2040 wrote to memory of 1284	2040	ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503.exe	19
PID 2040 wrote to memory of 1284	2040	ea186e8a796e0108d3fc573ddf026fc80e226743d6d2a754e6ddd9e3066d0503.exe	19

memory/1184-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1184-57-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1284-60-0x0000000002230000-0x0000000002233000-memory.dmp

Filesize
12KB

Download
memory/2040-56-0x0000000000401840-mapping.dmp

Download
memory/2040-55-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2040-59-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2040-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download