32b450b96e07b5a53b0c2edcf10ee673f47ed9f3c271c4039b030c7ad484bea4

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 04:14

Target

d52b2b96982c5e91eb9bbb1de461641d.exe
Size

72KB
MD5

d52b2b96982c5e91eb9bbb1de461641d
SHA1

15b1bb382b06f2e41f1e01538e149ef2985ba269
SHA256

32b450b96e07b5a53b0c2edcf10ee673f47ed9f3c271c4039b030c7ad484bea4
SHA512

e83b4ebd5a9e39b46ce803d059bb678135c6a048f8ece905f53c7de03deabf55a793b9aabe48facb72e3efd0e6cb6b3cf7946a60ba16c85d4f806f2cff05c46e
SSDEEP

1536:J4n5KIGUPMWLpbQ/UTO7pcXqXRQ7NkPE:rrUrcc/XgG7ec

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1yooj1d.exe	d52b2b96982c5e91eb9bbb1de461641d.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1yooj1d.exe	d52b2b96982c5e91eb9bbb1de461641d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2872 set thread context of 3040	2872	d52b2b96982c5e91eb9bbb1de461641d.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3040	d52b2b96982c5e91eb9bbb1de461641d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 3040	2872	d52b2b96982c5e91eb9bbb1de461641d.exe	28
PID 2872 wrote to memory of 3040	2872	d52b2b96982c5e91eb9bbb1de461641d.exe	28
PID 2872 wrote to memory of 3040	2872	d52b2b96982c5e91eb9bbb1de461641d.exe	28
PID 2872 wrote to memory of 3040	2872	d52b2b96982c5e91eb9bbb1de461641d.exe	28
PID 2872 wrote to memory of 3040	2872	d52b2b96982c5e91eb9bbb1de461641d.exe	28
PID 2872 wrote to memory of 3040	2872	d52b2b96982c5e91eb9bbb1de461641d.exe	28
PID 3040 wrote to memory of 1256	3040	d52b2b96982c5e91eb9bbb1de461641d.exe	21
PID 3040 wrote to memory of 1256	3040	d52b2b96982c5e91eb9bbb1de461641d.exe	21
PID 3040 wrote to memory of 1256	3040	d52b2b96982c5e91eb9bbb1de461641d.exe	21

memory/1256-11-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1256-12-0x0000000002140000-0x0000000002143000-memory.dmp

Filesize
12KB

Download
memory/1256-13-0x0000000002150000-0x0000000002152000-memory.dmp

Filesize
8KB

Download
memory/2872-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2872-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2872-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2872-2-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/2872-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2872-8-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3040-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3040-7-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3040-14-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download