99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a

Analysis

max time kernel
45s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 11:30

Target

99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a.exe
Size

52KB
MD5

fb35b957b349139cc2c9407e6dfd713f
SHA1

649ce636ac8c168c778437c0d87be4a2bb1b0f06
SHA256

99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a
SHA512

c25281e09c46bd0f54be424ec6f8f3474be98dfd44563c67e75ad8d51fb6cb38acb1873b94fe2dd190ee853099521d02f27e646df22e6b01b4ef5cb2f5f08c10
SSDEEP

768:9V+9y9nac8Tl86b30adKNMF0zibamGcqpcHBLZkL0Rj6pO1rda8QGnaoWrl+CQ+q:byydaP0asNw1VGc+cXkw+kZEjL8xw

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ejojyyejot.exe	99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ejojyyejot.exe	99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1888 set thread context of 2012	1888	99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2012	99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2012	1888	99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a.exe	27
PID 1888 wrote to memory of 2012	1888	99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a.exe	27
PID 1888 wrote to memory of 2012	1888	99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a.exe	27
PID 1888 wrote to memory of 2012	1888	99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a.exe	27
PID 1888 wrote to memory of 2012	1888	99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a.exe	27
PID 1888 wrote to memory of 2012	1888	99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a.exe	27
PID 2012 wrote to memory of 1264	2012	99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a.exe	11
PID 2012 wrote to memory of 1264	2012	99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a.exe	11
PID 2012 wrote to memory of 1264	2012	99c1191d3c216450581dfdfc91a818e3a5ce4c52ea8ba544f75fa44006c40d3a.exe	11

memory/1264-62-0x0000000002670000-0x0000000002673000-memory.dmp

Filesize
12KB

Download
memory/1888-55-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1888-54-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/1888-56-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1888-60-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2012-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2012-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2012-64-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download