dcedbcf3f73114cc385e85d4ffe57f2af60662411b308c51d8b46f1335ae8721

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 21:02

Target

7dfe42f21878171100ac1e32ea1fec5c.exe
Size

42KB
MD5

7dfe42f21878171100ac1e32ea1fec5c
SHA1

331544e4e71fb87bc5ac282b3b6522a27de46f67
SHA256

dcedbcf3f73114cc385e85d4ffe57f2af60662411b308c51d8b46f1335ae8721
SHA512

11951dec4135e6b69cf354a7296c53897c7ffc684fa1c5e3280bda0021e291df95921dc8ed2c7ff476963d9f9f0aa5a21f12ffdec744d13d874cd628d8907f10
SSDEEP

768:bzIXe/KSYbzMi5dI+kLYtfbUI+zIXX+J6Y6eKISn8OEVXEhPIQGhKwm1K:HI6KSYbzMiRk6fbURN6S48OYXhwg

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\idt5o1dyo.exe	7dfe42f21878171100ac1e32ea1fec5c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\idt5o1dyo.exe	7dfe42f21878171100ac1e32ea1fec5c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2488 set thread context of 2460	2488	7dfe42f21878171100ac1e32ea1fec5c.exe	14

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2460	7dfe42f21878171100ac1e32ea1fec5c.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2460	2488	7dfe42f21878171100ac1e32ea1fec5c.exe	14
PID 2488 wrote to memory of 2460	2488	7dfe42f21878171100ac1e32ea1fec5c.exe	14
PID 2488 wrote to memory of 2460	2488	7dfe42f21878171100ac1e32ea1fec5c.exe	14
PID 2488 wrote to memory of 2460	2488	7dfe42f21878171100ac1e32ea1fec5c.exe	14
PID 2488 wrote to memory of 2460	2488	7dfe42f21878171100ac1e32ea1fec5c.exe	14
PID 2488 wrote to memory of 2460	2488	7dfe42f21878171100ac1e32ea1fec5c.exe	14
PID 2460 wrote to memory of 1184	2460	7dfe42f21878171100ac1e32ea1fec5c.exe	21
PID 2460 wrote to memory of 1184	2460	7dfe42f21878171100ac1e32ea1fec5c.exe	21
PID 2460 wrote to memory of 1184	2460	7dfe42f21878171100ac1e32ea1fec5c.exe	21

memory/1184-6-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/1184-7-0x0000000002480000-0x0000000002483000-memory.dmp

Filesize
12KB

Download
memory/1184-8-0x0000000002490000-0x0000000002492000-memory.dmp

Filesize
8KB

Download
memory/2460-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2460-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2460-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2488-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download