02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 07:20

Target

02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe
Size

116KB
MD5

0793e14c75d527b4b566ddf3c21c4a83
SHA1

9e6a098df8dae03403fd14f47b869cf3d7661eb9
SHA256

02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0
SHA512

7d170ebc68b80d6876c2efe6e23e443386c2427d8a2dd8da5caba145a07a7806bc1e67a64e8af094ffd86393f6df7be6d98b515903227ca7a0f7700c1c446ccf
SSDEEP

3072:pIa5AZqZTlPqhrEKUpTSCRVYFyQlYZPx/qaCjZAYp:pL52yPqdClyFdWldqRAYp

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4728-132-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/4728-138-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4728 set thread context of 1076	4728	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1076	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe
1076	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe
1076	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe
1076	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4728	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 1076	4728	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe	82
PID 4728 wrote to memory of 1076	4728	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe	82
PID 4728 wrote to memory of 1076	4728	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe	82
PID 4728 wrote to memory of 1076	4728	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe	82
PID 4728 wrote to memory of 1076	4728	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe	82
PID 4728 wrote to memory of 1076	4728	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe	82
PID 4728 wrote to memory of 1076	4728	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe	82
PID 1076 wrote to memory of 1124	1076	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe	42
PID 1076 wrote to memory of 1124	1076	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe	42
PID 1076 wrote to memory of 1124	1076	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe	42
PID 1076 wrote to memory of 1124	1076	02dea1acab3b2688df53446c8f16e8e885aabaee578bd13453cd6365214f4bf0.exe	42

memory/1076-135-0x0000000000000000-mapping.dmp

Download
memory/1076-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1076-139-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1076-141-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1124-140-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4728-132-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4728-138-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download