60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201

Analysis

max time kernel
93s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 14:10

Target

60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201.exe
Size

61KB
MD5

7402831a9a4bc916c3791dc44f18ca3f
SHA1

221ae615e3d51acebfd5ae1ed55069abcf13f4ea
SHA256

60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201
SHA512

997405cd3f879f12e46ce762a1b1a39532970d0f5a0f391b67f267caf882ee455e3aab41e22282db997fc350cf3fd033ef21c5466d2bd9d1ff4395cec0691255
SSDEEP

1536:82WMz/aXYGIVTgVgeG3MCLrIME5AkC2vV/:PuKvFrlCt

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zoetjj4t9z4.exe	60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zoetjj4t9z4.exe	60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1108 set thread context of 1124	1108	60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1124	60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1124	1108	60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201.exe	28
PID 1108 wrote to memory of 1124	1108	60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201.exe	28
PID 1108 wrote to memory of 1124	1108	60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201.exe	28
PID 1108 wrote to memory of 1124	1108	60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201.exe	28
PID 1108 wrote to memory of 1124	1108	60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201.exe	28
PID 1108 wrote to memory of 1124	1108	60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201.exe	28
PID 1124 wrote to memory of 1272	1124	60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201.exe	15
PID 1124 wrote to memory of 1272	1124	60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201.exe	15
PID 1124 wrote to memory of 1272	1124	60bf68cf135d18365b7f918e51d10bff09ae5079429f6ab92ba40eb08eb55201.exe	15

memory/1108-54-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1108-55-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1108-56-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1108-57-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/1108-58-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1108-62-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1108-64-0x0000000001C50000-0x0000000001C6B000-memory.dmp

Filesize
108KB

Download
memory/1124-59-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1124-63-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1124-67-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1272-65-0x0000000002C30000-0x0000000002C33000-memory.dmp

Filesize
12KB

Download