bb1ebc5af256ac353b8ca2bd646363f73c93325698e65ff29fbd72e894113475

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:08

Target

0c87bc0f34e79c7b61acddcd32505aa8.exe
Size

60KB
MD5

0c87bc0f34e79c7b61acddcd32505aa8
SHA1

7e49b455907d21615db2b782f1e0a53609e12873
SHA256

bb1ebc5af256ac353b8ca2bd646363f73c93325698e65ff29fbd72e894113475
SHA512

7f8f244a141c42266e39d8eb89d92ed3275ef6745b6590b84dff13b2dcdaadddb61c37acd05873adf93036498c7898553cc0c06065c78442b3c7e95def2c5806
SSDEEP

1536:wzjsCiX1owiDJe8E1iEb0Edu/GHoWAjl857S67qpYS:wvUXdi4+Eb/du/GIZ47SKq2S

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5o1dyoo.exe	0c87bc0f34e79c7b61acddcd32505aa8.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5o1dyoo.exe	0c87bc0f34e79c7b61acddcd32505aa8.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2076 set thread context of 2664	2076	0c87bc0f34e79c7b61acddcd32505aa8.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2664	0c87bc0f34e79c7b61acddcd32505aa8.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2664	2076	0c87bc0f34e79c7b61acddcd32505aa8.exe	28
PID 2076 wrote to memory of 2664	2076	0c87bc0f34e79c7b61acddcd32505aa8.exe	28
PID 2076 wrote to memory of 2664	2076	0c87bc0f34e79c7b61acddcd32505aa8.exe	28
PID 2076 wrote to memory of 2664	2076	0c87bc0f34e79c7b61acddcd32505aa8.exe	28
PID 2076 wrote to memory of 2664	2076	0c87bc0f34e79c7b61acddcd32505aa8.exe	28
PID 2076 wrote to memory of 2664	2076	0c87bc0f34e79c7b61acddcd32505aa8.exe	28
PID 2664 wrote to memory of 1200	2664	0c87bc0f34e79c7b61acddcd32505aa8.exe	6
PID 2664 wrote to memory of 1200	2664	0c87bc0f34e79c7b61acddcd32505aa8.exe	6
PID 2664 wrote to memory of 1200	2664	0c87bc0f34e79c7b61acddcd32505aa8.exe	6

memory/1200-10-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1200-11-0x0000000002B50000-0x0000000002B53000-memory.dmp

Filesize
12KB

Download
memory/1200-12-0x0000000002B90000-0x0000000002B92000-memory.dmp

Filesize
8KB

Download
memory/2076-1-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2076-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2076-3-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2076-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2076-6-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2664-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2664-7-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2664-13-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download