46c3be1ef5ed88841e80c2dba54c01e220bd9f33913c86e039e242d3aeb0f8c7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 05:42

Target

86146458c21ebd0651b9fae2d03ae87e.exe
Size

52KB
MD5

86146458c21ebd0651b9fae2d03ae87e
SHA1

83fbf77ee3fad8476d3bf9b4c618935653fe808d
SHA256

46c3be1ef5ed88841e80c2dba54c01e220bd9f33913c86e039e242d3aeb0f8c7
SHA512

1045546e527e565eee1e27b3a266b9d7d6a770260785039b3fddf5828c72042dd40951dcac3540144e1b42366f6c6da7e3b078607a412007cc66262d0b9619d0
SSDEEP

768:vMPpihV2Ont0+0bnAJZG6+DZmmWjsrmcQiXRzitdYczZUEGUqxmyq7k:vyfOt0+EATGrYrjsrTRoH921myq7

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tjyoo1y0tto.exe	86146458c21ebd0651b9fae2d03ae87e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tjyoo1y0tto.exe	86146458c21ebd0651b9fae2d03ae87e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1984 set thread context of 1148	1984	86146458c21ebd0651b9fae2d03ae87e.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1148	86146458c21ebd0651b9fae2d03ae87e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1148	1984	86146458c21ebd0651b9fae2d03ae87e.exe	28
PID 1984 wrote to memory of 1148	1984	86146458c21ebd0651b9fae2d03ae87e.exe	28
PID 1984 wrote to memory of 1148	1984	86146458c21ebd0651b9fae2d03ae87e.exe	28
PID 1984 wrote to memory of 1148	1984	86146458c21ebd0651b9fae2d03ae87e.exe	28
PID 1984 wrote to memory of 1148	1984	86146458c21ebd0651b9fae2d03ae87e.exe	28
PID 1984 wrote to memory of 1148	1984	86146458c21ebd0651b9fae2d03ae87e.exe	28
PID 1148 wrote to memory of 1220	1148	86146458c21ebd0651b9fae2d03ae87e.exe	15
PID 1148 wrote to memory of 1220	1148	86146458c21ebd0651b9fae2d03ae87e.exe	15
PID 1148 wrote to memory of 1220	1148	86146458c21ebd0651b9fae2d03ae87e.exe	15

memory/1148-15-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1148-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1148-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1220-12-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1220-14-0x00000000024D0000-0x00000000024D2000-memory.dmp

Filesize
8KB

Download
memory/1220-13-0x00000000024C0000-0x00000000024C3000-memory.dmp

Filesize
12KB

Download
memory/1984-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1984-7-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1984-5-0x00000000003B0000-0x00000000003C8000-memory.dmp

Filesize
96KB

Download
memory/1984-8-0x00000000050E0000-0x00000000050F1000-memory.dmp

Filesize
68KB

Download
memory/1984-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1984-3-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1984-2-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download