6bad8ed360a449aee3f9b73a148f30040b19ad527d38d022609f3a85334d0d57

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:43

Target

0662c98ea5fde809ac6d61994e1a3451.exe
Size

89KB
MD5

0662c98ea5fde809ac6d61994e1a3451
SHA1

11471f9183f1b4de57a66bb47e231613de16da90
SHA256

6bad8ed360a449aee3f9b73a148f30040b19ad527d38d022609f3a85334d0d57
SHA512

d99a3ba04da346fa89ad94fababa2efd1cbb68e424c45218767ba856c000ed9a0f6350efd6a51bfc8e14c977f9449e27f6565b1dfa11a7c755370baadafd5ac5
SSDEEP

768:2yVLn278f+Rd4BDMVAaAF8tXID8wx8z+xSSJqM+fHfB68c8giIUq0YM7X:pDNhFSYfsUnof/s8X3q0d7X

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iiddyo0i0.exe	0662c98ea5fde809ac6d61994e1a3451.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iiddyo0i0.exe	0662c98ea5fde809ac6d61994e1a3451.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1320 set thread context of 2672	1320	0662c98ea5fde809ac6d61994e1a3451.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2672	0662c98ea5fde809ac6d61994e1a3451.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2672	1320	0662c98ea5fde809ac6d61994e1a3451.exe	28
PID 1320 wrote to memory of 2672	1320	0662c98ea5fde809ac6d61994e1a3451.exe	28
PID 1320 wrote to memory of 2672	1320	0662c98ea5fde809ac6d61994e1a3451.exe	28
PID 1320 wrote to memory of 2672	1320	0662c98ea5fde809ac6d61994e1a3451.exe	28
PID 1320 wrote to memory of 2672	1320	0662c98ea5fde809ac6d61994e1a3451.exe	28
PID 1320 wrote to memory of 2672	1320	0662c98ea5fde809ac6d61994e1a3451.exe	28
PID 2672 wrote to memory of 1292	2672	0662c98ea5fde809ac6d61994e1a3451.exe	14
PID 2672 wrote to memory of 1292	2672	0662c98ea5fde809ac6d61994e1a3451.exe	14
PID 2672 wrote to memory of 1292	2672	0662c98ea5fde809ac6d61994e1a3451.exe	14

memory/1292-11-0x0000000002A60000-0x0000000002A61000-memory.dmp

Filesize
4KB

Download
memory/1292-12-0x0000000002A70000-0x0000000002A73000-memory.dmp

Filesize
12KB

Download
memory/1292-13-0x0000000002A80000-0x0000000002A82000-memory.dmp

Filesize
8KB

Download
memory/1320-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1320-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1320-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1320-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1320-5-0x0000000000430000-0x000000000045C000-memory.dmp

Filesize
176KB

Download
memory/1320-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2672-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2672-8-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2672-14-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download