530f86eab402f7c7099c5141f2a1dc4e6947de292153dde19cb0d4a3e7ad332d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 23:22

Target

ff97bfae15b01e3d17d123829388d25b.exe
Size

66KB
MD5

ff97bfae15b01e3d17d123829388d25b
SHA1

04b1aec4e01a95a44793f1d181cf9cbb450e6ac5
SHA256

530f86eab402f7c7099c5141f2a1dc4e6947de292153dde19cb0d4a3e7ad332d
SHA512

feaf69445307a40bba9785b2cc6794196f046295e8271f14bf03f257e7e31e78d0fafbe02afbe41c82b5a2a4d3dbb94f9e82c41afb93bf75764a149f4ef03116
SSDEEP

1536:44PtjvQFZ7Fxqlq+MLMRqyBpIRqysUp/ZcyMP:44Ptjv2ZFxqMFyBpOsUU

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tiiddyo0i0.exe	ff97bfae15b01e3d17d123829388d25b.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tiiddyo0i0.exe	ff97bfae15b01e3d17d123829388d25b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2252 set thread context of 2556	2252	ff97bfae15b01e3d17d123829388d25b.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2556	ff97bfae15b01e3d17d123829388d25b.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2556	2252	ff97bfae15b01e3d17d123829388d25b.exe	28
PID 2252 wrote to memory of 2556	2252	ff97bfae15b01e3d17d123829388d25b.exe	28
PID 2252 wrote to memory of 2556	2252	ff97bfae15b01e3d17d123829388d25b.exe	28
PID 2252 wrote to memory of 2556	2252	ff97bfae15b01e3d17d123829388d25b.exe	28
PID 2252 wrote to memory of 2556	2252	ff97bfae15b01e3d17d123829388d25b.exe	28
PID 2252 wrote to memory of 2556	2252	ff97bfae15b01e3d17d123829388d25b.exe	28
PID 2556 wrote to memory of 1220	2556	ff97bfae15b01e3d17d123829388d25b.exe	7
PID 2556 wrote to memory of 1220	2556	ff97bfae15b01e3d17d123829388d25b.exe	7
PID 2556 wrote to memory of 1220	2556	ff97bfae15b01e3d17d123829388d25b.exe	7

memory/1220-11-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/1220-12-0x0000000002930000-0x0000000002933000-memory.dmp

Filesize
12KB

Download
memory/1220-13-0x0000000002940000-0x0000000002942000-memory.dmp

Filesize
8KB

Download
memory/2252-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2252-3-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

Filesize
4KB

Download
memory/2252-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2252-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2252-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2252-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2556-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2556-7-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2556-14-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download