97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:47

Target

97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd.exe
Size

59KB
MD5

1021583c8ec5a1271a5f0caad54ce690
SHA1

a5097778cf37f7f9ab8cdc212a7c30ae0e7ddf22
SHA256

97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd
SHA512

d011fd0553cc270b5a60cffc8b59aa7dbbdfd99edb22e2c8033916350acc00c6dd02ece7e6792d5a9b5631291f54bf898dd6b0cf1453ff810186394100dcb8bb
SSDEEP

1536:eyye9IUrTZeGD525DFtYLV2iL6OGuF1h1nPXYvdg8lkVFj/Q:eyyetrteGD+Hsh6efIvR4u

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y0yoydyj.exe	97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y0yoydyj.exe	97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1196 set thread context of 896	1196	97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
896	97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 896	1196	97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd.exe	27
PID 1196 wrote to memory of 896	1196	97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd.exe	27
PID 1196 wrote to memory of 896	1196	97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd.exe	27
PID 1196 wrote to memory of 896	1196	97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd.exe	27
PID 1196 wrote to memory of 896	1196	97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd.exe	27
PID 1196 wrote to memory of 896	1196	97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd.exe	27
PID 896 wrote to memory of 1388	896	97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd.exe	9
PID 896 wrote to memory of 1388	896	97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd.exe	9
PID 896 wrote to memory of 1388	896	97894de8d87b5617c33c44946cc141daced9c6b9a6e5843c01c73614fd8668bd.exe	9

memory/896-57-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/896-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/896-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1196-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1196-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1196-56-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1196-59-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1196-61-0x0000000000420000-0x000000000043A000-memory.dmp

Filesize
104KB

Download
memory/1388-63-0x0000000002A60000-0x0000000002A63000-memory.dmp

Filesize
12KB

Download