4b8830a027c8604592997b2a1785341e42d10fc1066ca29771d813600806fe0d

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/03/2024, 01:24

Target

d791271ebe3d51cb02a4a7b922a7e05a.exe
Size

42KB
MD5

d791271ebe3d51cb02a4a7b922a7e05a
SHA1

2fae7675d3ea8646abc550d4f7d8d3476b482b7a
SHA256

4b8830a027c8604592997b2a1785341e42d10fc1066ca29771d813600806fe0d
SHA512

64ab4ffdc96ae8c9b9a66438739abbc4c476b8ba628fabde91ee7cd322dd0347286d39995d2cf2a7ffe41e6f19bad6d9ad000847c26c9abceb5c3b335fc19549
SSDEEP

768:OzIXe/KSYbzMi5dIikLYtRb/I+zIXX+7283Xc1w6y/WjH+6b:WI6KSYbzMidk6Rb/y83Xc/y/W+I

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ddyo0i0d.exe	d791271ebe3d51cb02a4a7b922a7e05a.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ddyo0i0d.exe	d791271ebe3d51cb02a4a7b922a7e05a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2204 set thread context of 1448	2204	d791271ebe3d51cb02a4a7b922a7e05a.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1448	d791271ebe3d51cb02a4a7b922a7e05a.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1448	2204	d791271ebe3d51cb02a4a7b922a7e05a.exe	28
PID 2204 wrote to memory of 1448	2204	d791271ebe3d51cb02a4a7b922a7e05a.exe	28
PID 2204 wrote to memory of 1448	2204	d791271ebe3d51cb02a4a7b922a7e05a.exe	28
PID 2204 wrote to memory of 1448	2204	d791271ebe3d51cb02a4a7b922a7e05a.exe	28
PID 2204 wrote to memory of 1448	2204	d791271ebe3d51cb02a4a7b922a7e05a.exe	28
PID 2204 wrote to memory of 1448	2204	d791271ebe3d51cb02a4a7b922a7e05a.exe	28
PID 1448 wrote to memory of 1212	1448	d791271ebe3d51cb02a4a7b922a7e05a.exe	21
PID 1448 wrote to memory of 1212	1448	d791271ebe3d51cb02a4a7b922a7e05a.exe	21
PID 1448 wrote to memory of 1212	1448	d791271ebe3d51cb02a4a7b922a7e05a.exe	21

memory/1212-8-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1212-9-0x0000000002AC0000-0x0000000002AC3000-memory.dmp

Filesize
12KB

Download
memory/1212-10-0x0000000002AD0000-0x0000000002AD2000-memory.dmp

Filesize
8KB

Download
memory/1448-5-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1448-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1448-11-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2204-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2204-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2204-1-0x0000000000280000-0x0000000000292000-memory.dmp

Filesize
72KB

Download