4d523a5c4113980f196f56a9b18174f6eceda0e1ddd1a093862d8702f3c16478

Analysis

max time kernel
137s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 06:41

Target

88d3589b6480cf91687bf8f924dba5ce.exe
Size

42KB
MD5

88d3589b6480cf91687bf8f924dba5ce
SHA1

d525b43f148e5950f7f77ccbf1c98584acee5452
SHA256

4d523a5c4113980f196f56a9b18174f6eceda0e1ddd1a093862d8702f3c16478
SHA512

624e273410f3ef3b080d071a6d6fd5d851c6e54b1a8dac2af38c33b0eaee16f272eb5d4f9af67ec95e488f7e48784c4ba630d7f724f2277d310fa79726509151
SSDEEP

768:dzIXe/KSYbzMi5dIikLYtRblI+zIXX+nnCbfIeBcGwBUuzmraMmr1b:5I6KSYbzMidk6Rbl/CAG8Uum41

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\no75a75m70.exe	88d3589b6480cf91687bf8f924dba5ce.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\no75a75m70.exe	88d3589b6480cf91687bf8f924dba5ce.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2944 set thread context of 700	2944	88d3589b6480cf91687bf8f924dba5ce.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
700	88d3589b6480cf91687bf8f924dba5ce.exe
700	88d3589b6480cf91687bf8f924dba5ce.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 700	2944	88d3589b6480cf91687bf8f924dba5ce.exe	84
PID 2944 wrote to memory of 700	2944	88d3589b6480cf91687bf8f924dba5ce.exe	84
PID 2944 wrote to memory of 700	2944	88d3589b6480cf91687bf8f924dba5ce.exe	84
PID 2944 wrote to memory of 700	2944	88d3589b6480cf91687bf8f924dba5ce.exe	84
PID 2944 wrote to memory of 700	2944	88d3589b6480cf91687bf8f924dba5ce.exe	84
PID 700 wrote to memory of 3408	700	88d3589b6480cf91687bf8f924dba5ce.exe	78
PID 700 wrote to memory of 3408	700	88d3589b6480cf91687bf8f924dba5ce.exe	78
PID 700 wrote to memory of 3408	700	88d3589b6480cf91687bf8f924dba5ce.exe	78

memory/700-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/700-5-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2944-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2944-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download