7ae2202b08effc06ac782db48f9154fef94ed3d95a633679268b89be9e64fe6e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 05:33

Target

6498a126f29491ddf052cf20db189ea4.exe
Size

43KB
MD5

6498a126f29491ddf052cf20db189ea4
SHA1

e518ce476e1902796363d500c541b62ff56a5b67
SHA256

7ae2202b08effc06ac782db48f9154fef94ed3d95a633679268b89be9e64fe6e
SHA512

d6314321389e19ec5b26f3e07a77b49833d280ef433c2efda1bfcb5088d4a959f324bab3cdbf28545b77c041a2614e6c32f0206624a9c9fceba67100529642e7
SSDEEP

768:sL2/GuRJFl2JAzuBs9AlB+RagZYPKXb6+zIXX+EBvPsuNK39186ukvwW6:62/GuRJF8JAzss9AlWag9baphKNqDkvq

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ooii1ttoo.exe	6498a126f29491ddf052cf20db189ea4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ooii1ttoo.exe	6498a126f29491ddf052cf20db189ea4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2980 set thread context of 2316	2980	6498a126f29491ddf052cf20db189ea4.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2316	6498a126f29491ddf052cf20db189ea4.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2316	2980	6498a126f29491ddf052cf20db189ea4.exe	28
PID 2980 wrote to memory of 2316	2980	6498a126f29491ddf052cf20db189ea4.exe	28
PID 2980 wrote to memory of 2316	2980	6498a126f29491ddf052cf20db189ea4.exe	28
PID 2980 wrote to memory of 2316	2980	6498a126f29491ddf052cf20db189ea4.exe	28
PID 2980 wrote to memory of 2316	2980	6498a126f29491ddf052cf20db189ea4.exe	28
PID 2980 wrote to memory of 2316	2980	6498a126f29491ddf052cf20db189ea4.exe	28
PID 2316 wrote to memory of 1248	2316	6498a126f29491ddf052cf20db189ea4.exe	7
PID 2316 wrote to memory of 1248	2316	6498a126f29491ddf052cf20db189ea4.exe	7
PID 2316 wrote to memory of 1248	2316	6498a126f29491ddf052cf20db189ea4.exe	7

memory/1248-5-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/1248-6-0x0000000002510000-0x0000000002513000-memory.dmp

Filesize
12KB

Download
memory/1248-7-0x0000000002520000-0x0000000002522000-memory.dmp

Filesize
8KB

Download
memory/2316-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2316-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2316-8-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download