5db99368bb08775c78e6b1e4b7d783b6e9dd6928a20ac1357972381c30d7032e

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 22:26

Target

7e2a531c63990c925f139c19481a8b9e.exe
Size

89KB
MD5

7e2a531c63990c925f139c19481a8b9e
SHA1

3072ec9caca1f6f404ac525834c1bfe3018fd5b2
SHA256

5db99368bb08775c78e6b1e4b7d783b6e9dd6928a20ac1357972381c30d7032e
SHA512

64e4835bd69f46ee3b286dbf2327ea83ad15a308077164927cc5c3495872f3e7e2f1ac380ffd962b2ed60067b2589f04962ef43c284f72e87bad1107a06cfd81
SSDEEP

768:eLn2mXHRwnlkKPJU/V4Uk1AW4sfILv0rHyIJ/vP59+CwbCVMB4WkbTY:ENmpP+/ZKzfrHNPT+CwbCFT

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t5o1dyoo.exe	7e2a531c63990c925f139c19481a8b9e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t5o1dyoo.exe	7e2a531c63990c925f139c19481a8b9e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2552 set thread context of 2520	2552	7e2a531c63990c925f139c19481a8b9e.exe	16

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2520	7e2a531c63990c925f139c19481a8b9e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2520	2552	7e2a531c63990c925f139c19481a8b9e.exe	16
PID 2552 wrote to memory of 2520	2552	7e2a531c63990c925f139c19481a8b9e.exe	16
PID 2552 wrote to memory of 2520	2552	7e2a531c63990c925f139c19481a8b9e.exe	16
PID 2552 wrote to memory of 2520	2552	7e2a531c63990c925f139c19481a8b9e.exe	16
PID 2552 wrote to memory of 2520	2552	7e2a531c63990c925f139c19481a8b9e.exe	16
PID 2552 wrote to memory of 2520	2552	7e2a531c63990c925f139c19481a8b9e.exe	16
PID 2520 wrote to memory of 1192	2520	7e2a531c63990c925f139c19481a8b9e.exe	7
PID 2520 wrote to memory of 1192	2520	7e2a531c63990c925f139c19481a8b9e.exe	7
PID 2520 wrote to memory of 1192	2520	7e2a531c63990c925f139c19481a8b9e.exe	7

memory/1192-13-0x0000000002D50000-0x0000000002D51000-memory.dmp

Filesize
4KB

Download
memory/1192-14-0x0000000002D60000-0x0000000002D63000-memory.dmp

Filesize
12KB

Download
memory/1192-15-0x0000000002D70000-0x0000000002D72000-memory.dmp

Filesize
8KB

Download
memory/2520-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2520-10-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2520-16-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2552-3-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2552-2-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2552-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2552-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2552-4-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2552-7-0x0000000001C30000-0x0000000001C4F000-memory.dmp

Filesize
124KB

Download
memory/2552-8-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2552-9-0x0000000001C30000-0x0000000001C4F000-memory.dmp

Filesize
124KB

Download