e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0

Analysis

max time kernel
140s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 20:44

Target

e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0.exe
Size

42KB
MD5

f7b2148f1bd008efa0a7eb81146269ac
SHA1

728a98fd15c1e6cc2104f1eeceaed92510e16576
SHA256

e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0
SHA512

3a0a3f10279d965cd2d2d97955cbe47bc0f3e95fa3adde0f79e50d9f16ddeee47c7dcc785667a7f39eaf8745364c1e3780528bf2dc79605f2fa6f5f3b7285dfd
SSDEEP

768:QzIXeyKSYbzMi5dIEkLYthb3I+zIXX+GKIFpmdAzJM0jFF:IIPKSYbzMiHk6hb3ImYM0B

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5u75g75.exe	e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5u75g75.exe	e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 1428	1956	e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1428	e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0.exe
1428	e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1428	1956	e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0.exe	81
PID 1956 wrote to memory of 1428	1956	e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0.exe	81
PID 1956 wrote to memory of 1428	1956	e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0.exe	81
PID 1956 wrote to memory of 1428	1956	e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0.exe	81
PID 1956 wrote to memory of 1428	1956	e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0.exe	81
PID 1428 wrote to memory of 512	1428	e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0.exe	54
PID 1428 wrote to memory of 512	1428	e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0.exe	54
PID 1428 wrote to memory of 512	1428	e84320924ae6eec23ad6f75b1a55f8b250916495f4b46e1f8b10dea4272f02e0.exe	54

memory/1428-133-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1428-135-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1428-137-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1956-136-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download