20c44183314c3c4fcd06c87bf92ee1b070c801c4fb244856a1a4f460b3212fbf

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 07:32

Target

d58d86ad65b4eb481f00c883f1b5d76f.exe
Size

63KB
MD5

d58d86ad65b4eb481f00c883f1b5d76f
SHA1

e08d7f188979d841234ca0d2fccb547461d31d9b
SHA256

20c44183314c3c4fcd06c87bf92ee1b070c801c4fb244856a1a4f460b3212fbf
SHA512

14b1f53df10bf6a073cc72887194aef5d5900e53ef920ee4f04daa0db81c581356df355b4c7e3785110a513bda8c9db5b40ad21354d068619b29bad6845265c9
SSDEEP

1536:AdDli9bGnO8lCqarm2euXqdddddddddddddddddddddddddddddddddddddddddQ:AZg9bGO8lTvQXNRxm4Vh

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iyyt1oiidt.exe	d58d86ad65b4eb481f00c883f1b5d76f.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iyyt1oiidt.exe	d58d86ad65b4eb481f00c883f1b5d76f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2172 set thread context of 2296	2172	d58d86ad65b4eb481f00c883f1b5d76f.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2296	d58d86ad65b4eb481f00c883f1b5d76f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2296	2172	d58d86ad65b4eb481f00c883f1b5d76f.exe	28
PID 2172 wrote to memory of 2296	2172	d58d86ad65b4eb481f00c883f1b5d76f.exe	28
PID 2172 wrote to memory of 2296	2172	d58d86ad65b4eb481f00c883f1b5d76f.exe	28
PID 2172 wrote to memory of 2296	2172	d58d86ad65b4eb481f00c883f1b5d76f.exe	28
PID 2172 wrote to memory of 2296	2172	d58d86ad65b4eb481f00c883f1b5d76f.exe	28
PID 2172 wrote to memory of 2296	2172	d58d86ad65b4eb481f00c883f1b5d76f.exe	28
PID 2296 wrote to memory of 1196	2296	d58d86ad65b4eb481f00c883f1b5d76f.exe	21
PID 2296 wrote to memory of 1196	2296	d58d86ad65b4eb481f00c883f1b5d76f.exe	21
PID 2296 wrote to memory of 1196	2296	d58d86ad65b4eb481f00c883f1b5d76f.exe	21

memory/1196-12-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/1196-14-0x0000000002570000-0x0000000002572000-memory.dmp

Filesize
8KB

Download
memory/1196-13-0x0000000002560000-0x0000000002563000-memory.dmp

Filesize
12KB

Download
memory/2172-4-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2172-3-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2172-7-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2172-8-0x00000000024D0000-0x00000000024F2000-memory.dmp

Filesize
136KB

Download
memory/2172-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2172-1-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2172-2-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2296-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2296-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2296-15-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download