9a5cc4b225b1c010449f68e9d2b62daf74a21967cfef516512047337a0cdc13a

Analysis

max time kernel
121s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:02

Target

13a90d3d594d761ab0aabe591f8ff198.exe
Size

100KB
MD5

13a90d3d594d761ab0aabe591f8ff198
SHA1

d113db8e7a1e555faa2f1f92691f1e9ce26ff6be
SHA256

9a5cc4b225b1c010449f68e9d2b62daf74a21967cfef516512047337a0cdc13a
SHA512

e559f11c7a53e92924ea7f7a0a0551e056478907525428fde0bd2f479f184c4c6fed7f39174b0221bf702347079eef3203231249f54de34f4bb6f8f22ae1e54f
SSDEEP

1536:uD39Hoae3JxRwtCVwvNKH2hBrV6VdYEnExl7QmI8owlsHO0ea:uD3ZVe5Itg7WhBh4DExlXFnsv7

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ojjdt9oojd.exe	13a90d3d594d761ab0aabe591f8ff198.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ojjdt9oojd.exe	13a90d3d594d761ab0aabe591f8ff198.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2124 set thread context of 2708	2124	13a90d3d594d761ab0aabe591f8ff198.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2708	13a90d3d594d761ab0aabe591f8ff198.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2708	2124	13a90d3d594d761ab0aabe591f8ff198.exe	28
PID 2124 wrote to memory of 2708	2124	13a90d3d594d761ab0aabe591f8ff198.exe	28
PID 2124 wrote to memory of 2708	2124	13a90d3d594d761ab0aabe591f8ff198.exe	28
PID 2124 wrote to memory of 2708	2124	13a90d3d594d761ab0aabe591f8ff198.exe	28
PID 2124 wrote to memory of 2708	2124	13a90d3d594d761ab0aabe591f8ff198.exe	28
PID 2124 wrote to memory of 2708	2124	13a90d3d594d761ab0aabe591f8ff198.exe	28
PID 2708 wrote to memory of 1384	2708	13a90d3d594d761ab0aabe591f8ff198.exe	7
PID 2708 wrote to memory of 1384	2708	13a90d3d594d761ab0aabe591f8ff198.exe	7
PID 2708 wrote to memory of 1384	2708	13a90d3d594d761ab0aabe591f8ff198.exe	7

memory/1384-15-0x0000000002620000-0x0000000002622000-memory.dmp

Filesize
8KB

Download
memory/1384-13-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/1384-14-0x0000000002610000-0x0000000002613000-memory.dmp

Filesize
12KB

Download
memory/2124-6-0x0000000000420000-0x000000000043D000-memory.dmp

Filesize
116KB

Download
memory/2124-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2124-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2124-8-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2124-9-0x0000000000420000-0x000000000043D000-memory.dmp

Filesize
116KB

Download
memory/2124-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2124-4-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2124-1-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/2708-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2708-10-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2708-16-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download