42d5900511cb18ddaf41824873988ceb31a61c66a476a40001acbd9a7590fd2c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 04:15

Target

534571e3bf668aab67bba5750d40426f.exe
Size

62KB
MD5

534571e3bf668aab67bba5750d40426f
SHA1

c4ae47bdc66884e500c883d60da00a921fbfc241
SHA256

42d5900511cb18ddaf41824873988ceb31a61c66a476a40001acbd9a7590fd2c
SHA512

0de3f91b121fe6fc947169457827c4fe9f0c4d08584d34e59512321a40a2d289886a097758ba8663c772125e7d33bfaa83da1732f2acecc5fc98ae0eb5f1976c
SSDEEP

768:tKe8/hAbuN+XJQ2YEBwKtWch+vkH1JYkyEGMAxV81FVTs+n11g8svb:wnAbekJQ2dfh+6TE7MWiTDnngrvb

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\431dyoo.exe	534571e3bf668aab67bba5750d40426f.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\431dyoo.exe	534571e3bf668aab67bba5750d40426f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1696 set thread context of 1148	1696	534571e3bf668aab67bba5750d40426f.exe	14

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1148	534571e3bf668aab67bba5750d40426f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1148	1696	534571e3bf668aab67bba5750d40426f.exe	14
PID 1696 wrote to memory of 1148	1696	534571e3bf668aab67bba5750d40426f.exe	14
PID 1696 wrote to memory of 1148	1696	534571e3bf668aab67bba5750d40426f.exe	14
PID 1696 wrote to memory of 1148	1696	534571e3bf668aab67bba5750d40426f.exe	14
PID 1696 wrote to memory of 1148	1696	534571e3bf668aab67bba5750d40426f.exe	14
PID 1696 wrote to memory of 1148	1696	534571e3bf668aab67bba5750d40426f.exe	14
PID 1148 wrote to memory of 1220	1148	534571e3bf668aab67bba5750d40426f.exe	16
PID 1148 wrote to memory of 1220	1148	534571e3bf668aab67bba5750d40426f.exe	16
PID 1148 wrote to memory of 1220	1148	534571e3bf668aab67bba5750d40426f.exe	16

memory/1148-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1148-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1148-15-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1220-13-0x00000000024C0000-0x00000000024C3000-memory.dmp

Filesize
12KB

Download
memory/1220-12-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1220-14-0x00000000024D0000-0x00000000024D2000-memory.dmp

Filesize
8KB

Download
memory/1696-6-0x00000000003E0000-0x00000000003FA000-memory.dmp

Filesize
104KB

Download
memory/1696-2-0x0000000002070000-0x0000000002071000-memory.dmp

Filesize
4KB

Download
memory/1696-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1696-3-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1696-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1696-1-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1696-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download