4436520b44887e9af3a30c546daf6b8faa6f862ae66bba0e41d6b5376de24f91

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 00:28

Target

9803bd1cd7b9ef71a211fade6ab2bbf6.exe
Size

57KB
MD5

9803bd1cd7b9ef71a211fade6ab2bbf6
SHA1

f245e044f4235ac82078aa69bcdcdc84b6c9c46b
SHA256

4436520b44887e9af3a30c546daf6b8faa6f862ae66bba0e41d6b5376de24f91
SHA512

b99c32b7275fc5a3e6ed3a19d02d7d4702abb28ab1cfc9ff8223ad0a40a32da00fb4921d91379901daf35c2911a5b6e0fad312f5d89a8e63a6c725544195a694
SSDEEP

768:w3Nl57q8uNa2gdN6r9iXW9ofVj37lsFPWu02Z8cI2aTiW+XaX:wlGna2wjm9oF37lUnZK+qX

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ddttod9y0.exe	9803bd1cd7b9ef71a211fade6ab2bbf6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ddttod9y0.exe	9803bd1cd7b9ef71a211fade6ab2bbf6.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 2364	2148	9803bd1cd7b9ef71a211fade6ab2bbf6.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2364	9803bd1cd7b9ef71a211fade6ab2bbf6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2364	2148	9803bd1cd7b9ef71a211fade6ab2bbf6.exe	28
PID 2148 wrote to memory of 2364	2148	9803bd1cd7b9ef71a211fade6ab2bbf6.exe	28
PID 2148 wrote to memory of 2364	2148	9803bd1cd7b9ef71a211fade6ab2bbf6.exe	28
PID 2148 wrote to memory of 2364	2148	9803bd1cd7b9ef71a211fade6ab2bbf6.exe	28
PID 2148 wrote to memory of 2364	2148	9803bd1cd7b9ef71a211fade6ab2bbf6.exe	28
PID 2148 wrote to memory of 2364	2148	9803bd1cd7b9ef71a211fade6ab2bbf6.exe	28
PID 2364 wrote to memory of 1200	2364	9803bd1cd7b9ef71a211fade6ab2bbf6.exe	14
PID 2364 wrote to memory of 1200	2364	9803bd1cd7b9ef71a211fade6ab2bbf6.exe	14
PID 2364 wrote to memory of 1200	2364	9803bd1cd7b9ef71a211fade6ab2bbf6.exe	14

memory/1200-10-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/1200-11-0x0000000002200000-0x0000000002203000-memory.dmp

Filesize
12KB

Download
memory/1200-12-0x0000000002210000-0x0000000002212000-memory.dmp

Filesize
8KB

Download
memory/2148-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2148-2-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2148-1-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2148-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2148-7-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2364-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2364-6-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2364-13-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download