56f1b4bc6868c62c62d258d1bf7b5927bc3c745a7825e22b2639eca18e1392f1

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 18:25

Target

0badeaa15917cde11e4994539a536494.exe
Size

68KB
MD5

0badeaa15917cde11e4994539a536494
SHA1

105523ae48706cb5de88cc827d03d6f3197ca097
SHA256

56f1b4bc6868c62c62d258d1bf7b5927bc3c745a7825e22b2639eca18e1392f1
SHA512

6e05b8d0693d4c306547e25f7575bd6722509fdf072523d006f61c2116c9c5378569714fe90d2c3eccd6aef6cfa9437eea5c812d97ba74c9f61a9bd971a48124
SSDEEP

1536:3pz8+HptZUqIq7es/vKIlrEJkPUgrqQYldvq:3RJp/vzrENlN

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y8oj1dyytjy.exe	0badeaa15917cde11e4994539a536494.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y8oj1dyytjy.exe	0badeaa15917cde11e4994539a536494.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 1744	1732	0badeaa15917cde11e4994539a536494.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1744	0badeaa15917cde11e4994539a536494.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1744	1732	0badeaa15917cde11e4994539a536494.exe	28
PID 1732 wrote to memory of 1744	1732	0badeaa15917cde11e4994539a536494.exe	28
PID 1732 wrote to memory of 1744	1732	0badeaa15917cde11e4994539a536494.exe	28
PID 1732 wrote to memory of 1744	1732	0badeaa15917cde11e4994539a536494.exe	28
PID 1732 wrote to memory of 1744	1732	0badeaa15917cde11e4994539a536494.exe	28
PID 1732 wrote to memory of 1744	1732	0badeaa15917cde11e4994539a536494.exe	28
PID 1744 wrote to memory of 1220	1744	0badeaa15917cde11e4994539a536494.exe	15
PID 1744 wrote to memory of 1220	1744	0badeaa15917cde11e4994539a536494.exe	15
PID 1744 wrote to memory of 1220	1744	0badeaa15917cde11e4994539a536494.exe	15

memory/1220-10-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/1220-11-0x0000000002AA0000-0x0000000002AA3000-memory.dmp

Filesize
12KB

Download
memory/1220-12-0x0000000002AB0000-0x0000000002AB2000-memory.dmp

Filesize
8KB

Download
memory/1732-3-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1732-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1732-1-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1732-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1732-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1744-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1744-6-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1744-13-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download