dcedbcf3f73114cc385e85d4ffe57f2af60662411b308c51d8b46f1335ae8721

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2024 21:02

Target

7dfe42f21878171100ac1e32ea1fec5c.exe
Size

42KB
MD5

7dfe42f21878171100ac1e32ea1fec5c
SHA1

331544e4e71fb87bc5ac282b3b6522a27de46f67
SHA256

dcedbcf3f73114cc385e85d4ffe57f2af60662411b308c51d8b46f1335ae8721
SHA512

11951dec4135e6b69cf354a7296c53897c7ffc684fa1c5e3280bda0021e291df95921dc8ed2c7ff476963d9f9f0aa5a21f12ffdec744d13d874cd628d8907f10
SSDEEP

768:bzIXe/KSYbzMi5dI+kLYtfbUI+zIXX+J6Y6eKISn8OEVXEhPIQGhKwm1K:HI6KSYbzMiRk6fbURN6S48OYXhwg

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5i75u75.exe	7dfe42f21878171100ac1e32ea1fec5c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5i75u75.exe	7dfe42f21878171100ac1e32ea1fec5c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3316 set thread context of 1048	3316	7dfe42f21878171100ac1e32ea1fec5c.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1048	7dfe42f21878171100ac1e32ea1fec5c.exe
1048	7dfe42f21878171100ac1e32ea1fec5c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 1048	3316	7dfe42f21878171100ac1e32ea1fec5c.exe	86
PID 3316 wrote to memory of 1048	3316	7dfe42f21878171100ac1e32ea1fec5c.exe	86
PID 3316 wrote to memory of 1048	3316	7dfe42f21878171100ac1e32ea1fec5c.exe	86
PID 3316 wrote to memory of 1048	3316	7dfe42f21878171100ac1e32ea1fec5c.exe	86
PID 3316 wrote to memory of 1048	3316	7dfe42f21878171100ac1e32ea1fec5c.exe	86
PID 1048 wrote to memory of 3468	1048	7dfe42f21878171100ac1e32ea1fec5c.exe	79
PID 1048 wrote to memory of 3468	1048	7dfe42f21878171100ac1e32ea1fec5c.exe	79
PID 1048 wrote to memory of 3468	1048	7dfe42f21878171100ac1e32ea1fec5c.exe	79

memory/1048-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1048-5-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3316-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3316-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download