29fa15b0204320bf591d1d70f1c2c765b6f5609b39d056ba38706fab1f6b0453

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:46

Target

79fb3defa212d88468854d62cbe40f4b.exe
Size

65KB
MD5

79fb3defa212d88468854d62cbe40f4b
SHA1

3962183dd378c258eda943537c2c910a27c335fd
SHA256

29fa15b0204320bf591d1d70f1c2c765b6f5609b39d056ba38706fab1f6b0453
SHA512

45ef4d97e5890f35ad1079ec06b52c766c0a79cc19888a39b01a19ebafd2cbca1cf7a7f3542327e8067846a4f1eac49141db1361a439e077200b7d67d40e617e
SSDEEP

768:UT240vQF3p7FJDqlqtg9NLfcLMRyxyBlPCHgeK6KMwM0FIu6sOw3659YsG3Pn:UaRvQFZ7Fxqlq+MLMRqyBpLea76sd6m

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jd5toojdd6.exe	79fb3defa212d88468854d62cbe40f4b.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jd5toojdd6.exe	79fb3defa212d88468854d62cbe40f4b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2432 set thread context of 2628	2432	79fb3defa212d88468854d62cbe40f4b.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2628	79fb3defa212d88468854d62cbe40f4b.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2628	2432	79fb3defa212d88468854d62cbe40f4b.exe	28
PID 2432 wrote to memory of 2628	2432	79fb3defa212d88468854d62cbe40f4b.exe	28
PID 2432 wrote to memory of 2628	2432	79fb3defa212d88468854d62cbe40f4b.exe	28
PID 2432 wrote to memory of 2628	2432	79fb3defa212d88468854d62cbe40f4b.exe	28
PID 2432 wrote to memory of 2628	2432	79fb3defa212d88468854d62cbe40f4b.exe	28
PID 2432 wrote to memory of 2628	2432	79fb3defa212d88468854d62cbe40f4b.exe	28
PID 2628 wrote to memory of 1196	2628	79fb3defa212d88468854d62cbe40f4b.exe	24
PID 2628 wrote to memory of 1196	2628	79fb3defa212d88468854d62cbe40f4b.exe	24
PID 2628 wrote to memory of 1196	2628	79fb3defa212d88468854d62cbe40f4b.exe	24

memory/1196-13-0x0000000002200000-0x0000000002203000-memory.dmp

Filesize
12KB

Download
memory/1196-14-0x0000000002210000-0x0000000002212000-memory.dmp

Filesize
8KB

Download
memory/1196-12-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2432-2-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2432-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2432-5-0x0000000000510000-0x000000000052B000-memory.dmp

Filesize
108KB

Download
memory/2432-9-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2432-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2432-3-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2432-4-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/2628-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2628-8-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2628-15-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download