7ae2202b08effc06ac782db48f9154fef94ed3d95a633679268b89be9e64fe6e

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 05:33

Target

6498a126f29491ddf052cf20db189ea4.exe
Size

43KB
MD5

6498a126f29491ddf052cf20db189ea4
SHA1

e518ce476e1902796363d500c541b62ff56a5b67
SHA256

7ae2202b08effc06ac782db48f9154fef94ed3d95a633679268b89be9e64fe6e
SHA512

d6314321389e19ec5b26f3e07a77b49833d280ef433c2efda1bfcb5088d4a959f324bab3cdbf28545b77c041a2614e6c32f0206624a9c9fceba67100529642e7
SSDEEP

768:sL2/GuRJFl2JAzuBs9AlB+RagZYPKXb6+zIXX+EBvPsuNK39186ukvwW6:62/GuRJF8JAzss9AlWag9baphKNqDkvq

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mmhyytkkfw.exe	6498a126f29491ddf052cf20db189ea4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mmhyytkkfw.exe	6498a126f29491ddf052cf20db189ea4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2488 set thread context of 1740	2488	6498a126f29491ddf052cf20db189ea4.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1740	6498a126f29491ddf052cf20db189ea4.exe
1740	6498a126f29491ddf052cf20db189ea4.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1740	2488	6498a126f29491ddf052cf20db189ea4.exe	88
PID 2488 wrote to memory of 1740	2488	6498a126f29491ddf052cf20db189ea4.exe	88
PID 2488 wrote to memory of 1740	2488	6498a126f29491ddf052cf20db189ea4.exe	88
PID 2488 wrote to memory of 1740	2488	6498a126f29491ddf052cf20db189ea4.exe	88
PID 2488 wrote to memory of 1740	2488	6498a126f29491ddf052cf20db189ea4.exe	88
PID 1740 wrote to memory of 3532	1740	6498a126f29491ddf052cf20db189ea4.exe	50
PID 1740 wrote to memory of 3532	1740	6498a126f29491ddf052cf20db189ea4.exe	50
PID 1740 wrote to memory of 3532	1740	6498a126f29491ddf052cf20db189ea4.exe	50

memory/1740-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1740-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download