711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d

Analysis

max time kernel
19s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 13:43

Target

711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe
Size

62KB
MD5

701d52c18945c7191b7cacea1d8c1c05
SHA1

b8f560dcc9abb1861cd7fdf6771cb8dbb01c5041
SHA256

711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d
SHA512

1e0a640275f62f73fe17ffe72b8c864228741a822a5dc9e196205e14607df457e6b33e0d47737b6499a66425475ba6d6302daa85609340c42a22cfcfd97f524c
SSDEEP

1536:E25b7AbekJQ2dfh+6TE7MWwP5GuqhcJ3YXju:l5bci6pJTE7U5GuqhcJ3Yzu

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ojetjyyj2.exe	711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ojetjyyj2.exe	711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 564 set thread context of 280	564	711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
280	711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 280	564	711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe	28
PID 564 wrote to memory of 280	564	711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe	28
PID 564 wrote to memory of 280	564	711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe	28
PID 564 wrote to memory of 280	564	711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe	28
PID 564 wrote to memory of 280	564	711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe	28
PID 564 wrote to memory of 280	564	711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe	28
PID 280 wrote to memory of 1220	280	711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe	20
PID 280 wrote to memory of 1220	280	711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe	20
PID 280 wrote to memory of 1220	280	711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe	20

memory/280-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/280-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/280-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/564-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/564-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/564-56-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/564-57-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/564-60-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1220-63-0x0000000002A10000-0x0000000002A13000-memory.dmp

Filesize
12KB

Download