08fcb3ebe8cea39b828ea79211d78255a8474b07cf63c4d7ab6d364b34246257

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:32

Target

f623c7c8288bdb76a964f063631350bc.exe
Size

85KB
MD5

f623c7c8288bdb76a964f063631350bc
SHA1

b041bb4e7f77344744ce79e145059f741fe4bfd9
SHA256

08fcb3ebe8cea39b828ea79211d78255a8474b07cf63c4d7ab6d364b34246257
SHA512

0df9bfad2f284f4aa85cf47e07ef6141feae1376dd3c2480192dd6d3e6bd746435f4e4663f678f13a57827635b754e8e0b5bc135be3eb8d0e5aa5d7d8e8b7984
SSDEEP

1536:zyySMUrTZeGD525DFtYLV2iL6OGuF1h1LmX+dLnkO1YbV7lvyR18esGfNO3+9l:zyySHrteGD+Hsh6eywLF1YdNyR187Gfb

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oddyytjjdt9.exe	f623c7c8288bdb76a964f063631350bc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oddyytjjdt9.exe	f623c7c8288bdb76a964f063631350bc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 2432	1932	f623c7c8288bdb76a964f063631350bc.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2432	f623c7c8288bdb76a964f063631350bc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2432	1932	f623c7c8288bdb76a964f063631350bc.exe	28
PID 1932 wrote to memory of 2432	1932	f623c7c8288bdb76a964f063631350bc.exe	28
PID 1932 wrote to memory of 2432	1932	f623c7c8288bdb76a964f063631350bc.exe	28
PID 1932 wrote to memory of 2432	1932	f623c7c8288bdb76a964f063631350bc.exe	28
PID 1932 wrote to memory of 2432	1932	f623c7c8288bdb76a964f063631350bc.exe	28
PID 1932 wrote to memory of 2432	1932	f623c7c8288bdb76a964f063631350bc.exe	28
PID 2432 wrote to memory of 1208	2432	f623c7c8288bdb76a964f063631350bc.exe	13
PID 2432 wrote to memory of 1208	2432	f623c7c8288bdb76a964f063631350bc.exe	13
PID 2432 wrote to memory of 1208	2432	f623c7c8288bdb76a964f063631350bc.exe	13

memory/1208-12-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/1208-16-0x0000000002170000-0x0000000002172000-memory.dmp

Filesize
8KB

Download
memory/1208-14-0x0000000002160000-0x0000000002163000-memory.dmp

Filesize
12KB

Download
memory/1932-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1932-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1932-5-0x00000000005B0000-0x00000000005C8000-memory.dmp

Filesize
96KB

Download
memory/1932-8-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1932-3-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1932-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1932-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2432-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2432-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2432-18-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download