1cee6a6c18c5f264469185bbe3b70bcfe9ac996ce3bacee504e9e5fd6dbc50b2

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:17

Target

0e2c38cfd99c79ccd8c969232b278f0f.exe
Size

74KB
MD5

0e2c38cfd99c79ccd8c969232b278f0f
SHA1

38d98b21037f2f40a9006e1bcf6620a4956e6fe5
SHA256

1cee6a6c18c5f264469185bbe3b70bcfe9ac996ce3bacee504e9e5fd6dbc50b2
SHA512

cb41e091fc440feaa46dbb81d5c366e345fbf8d5e6170e068ea73e5cd8e13cd5748fab94196423e7ef68589c0d6401335e6809b19e2aa07a789e624d6d5d429f
SSDEEP

1536:M0ynjzs0bZPrDaAiUuKpzsLTj/mzQGqSkdx88qaypU/zNyJ9io:MJjzJbRrDhiDK2LXIqSkdupIxqIo

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6idyy7t.exe	0e2c38cfd99c79ccd8c969232b278f0f.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6idyy7t.exe	0e2c38cfd99c79ccd8c969232b278f0f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2176 set thread context of 1756	2176	0e2c38cfd99c79ccd8c969232b278f0f.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1756	0e2c38cfd99c79ccd8c969232b278f0f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1756	2176	0e2c38cfd99c79ccd8c969232b278f0f.exe	28
PID 2176 wrote to memory of 1756	2176	0e2c38cfd99c79ccd8c969232b278f0f.exe	28
PID 2176 wrote to memory of 1756	2176	0e2c38cfd99c79ccd8c969232b278f0f.exe	28
PID 2176 wrote to memory of 1756	2176	0e2c38cfd99c79ccd8c969232b278f0f.exe	28
PID 2176 wrote to memory of 1756	2176	0e2c38cfd99c79ccd8c969232b278f0f.exe	28
PID 2176 wrote to memory of 1756	2176	0e2c38cfd99c79ccd8c969232b278f0f.exe	28
PID 1756 wrote to memory of 1264	1756	0e2c38cfd99c79ccd8c969232b278f0f.exe	15
PID 1756 wrote to memory of 1264	1756	0e2c38cfd99c79ccd8c969232b278f0f.exe	15
PID 1756 wrote to memory of 1264	1756	0e2c38cfd99c79ccd8c969232b278f0f.exe	15

memory/1264-7-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/1264-8-0x0000000002A10000-0x0000000002A13000-memory.dmp

Filesize
12KB

Download
memory/1264-9-0x0000000002A20000-0x0000000002A22000-memory.dmp

Filesize
8KB

Download
memory/1756-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1756-4-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1756-10-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2176-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2176-3-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download