6b6cae9d19ea74893b5fe0927a87396ccce1d6bbfffcfb491507e5cd25c19f48

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 19:22

Target

443dec245ffc05ccfc96d60dff1ff603.exe
Size

63KB
MD5

443dec245ffc05ccfc96d60dff1ff603
SHA1

e419748750a13a3f6e047972206b5b29d9eb7fe1
SHA256

6b6cae9d19ea74893b5fe0927a87396ccce1d6bbfffcfb491507e5cd25c19f48
SHA512

abd7186e029aba8410d0eb5567bab2213e934cad54af14747f4dea627fe8deb3267640d6b8bac2cad004683a4eaedb5f8f2ef3012ff8d954f953f1a857a03e5e
SSDEEP

1536:kDigGBJxCqarm2euXqddddddddddddddddddddddddddddddddddddddddddddds:kegG9TvQXNx+m3NJ

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t6d5y2ojy.exe	443dec245ffc05ccfc96d60dff1ff603.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t6d5y2ojy.exe	443dec245ffc05ccfc96d60dff1ff603.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1704 set thread context of 2288	1704	443dec245ffc05ccfc96d60dff1ff603.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2288	443dec245ffc05ccfc96d60dff1ff603.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2288	1704	443dec245ffc05ccfc96d60dff1ff603.exe	28
PID 1704 wrote to memory of 2288	1704	443dec245ffc05ccfc96d60dff1ff603.exe	28
PID 1704 wrote to memory of 2288	1704	443dec245ffc05ccfc96d60dff1ff603.exe	28
PID 1704 wrote to memory of 2288	1704	443dec245ffc05ccfc96d60dff1ff603.exe	28
PID 1704 wrote to memory of 2288	1704	443dec245ffc05ccfc96d60dff1ff603.exe	28
PID 1704 wrote to memory of 2288	1704	443dec245ffc05ccfc96d60dff1ff603.exe	28
PID 2288 wrote to memory of 1224	2288	443dec245ffc05ccfc96d60dff1ff603.exe	16
PID 2288 wrote to memory of 1224	2288	443dec245ffc05ccfc96d60dff1ff603.exe	16
PID 2288 wrote to memory of 1224	2288	443dec245ffc05ccfc96d60dff1ff603.exe	16

memory/1224-11-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/1224-12-0x0000000002A20000-0x0000000002A23000-memory.dmp

Filesize
12KB

Download
memory/1224-13-0x0000000002A30000-0x0000000002A32000-memory.dmp

Filesize
8KB

Download
memory/1704-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1704-1-0x0000000001CF0000-0x0000000001CF1000-memory.dmp

Filesize
4KB

Download
memory/1704-3-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1704-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1704-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1704-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2288-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2288-8-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2288-14-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download