ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb

Analysis

max time kernel
240s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 05:53

Target

ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb.exe
Size

54KB
MD5

07968f42346da2f13e1a1bc53d7dc39d
SHA1

66d4abd7bedeb7812ac2ce99ec9f143545081a63
SHA256

ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb
SHA512

9adafed8e8e6f7764db8308ada5de28505bcd3ab8579d6e390479702ee4bce465148bd7b4d73e968fd63b7861bd065ab4a01cd0c23b0f1dade87526d53608334
SSDEEP

768:LzxaS3WeM+TOtdEvCSb4MajQ1Y3DUAhQ48nXt455DcOxcP9Pls6/APQooSk0XGVX:nw2We/ToEvCe4MKQ289ghcgiAPQm37e

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9z9f4kz.exe	ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9z9f4kz.exe	ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1660 set thread context of 560	1660	ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
560	ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 560	1660	ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb.exe	28
PID 1660 wrote to memory of 560	1660	ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb.exe	28
PID 1660 wrote to memory of 560	1660	ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb.exe	28
PID 1660 wrote to memory of 560	1660	ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb.exe	28
PID 1660 wrote to memory of 560	1660	ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb.exe	28
PID 1660 wrote to memory of 560	1660	ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb.exe	28
PID 560 wrote to memory of 1284	560	ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb.exe	15
PID 560 wrote to memory of 1284	560	ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb.exe	15
PID 560 wrote to memory of 1284	560	ca83828812762519667158b2306c92c0a18903fc60060f8ef2dc04316b7287eb.exe	15

memory/560-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/560-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/560-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1284-63-0x0000000002790000-0x0000000002793000-memory.dmp

Filesize
12KB

Download
memory/1660-54-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1660-55-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/1660-56-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1660-57-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download
memory/1660-61-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download