a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 09:56

Target

a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe
Size

52KB
MD5

b1a05c491217048773c3007881112317
SHA1

8b3c01468aa51fa25ccdc40c118c4517e248123b
SHA256

a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5
SHA512

f0bf830a93fa28f9469d7c33b9098bc23962c090a8985f2f8ca6cf162451b6f96f98a0d9d747f46f27b5315f940bce1bea671dd4b491836a83d1b3fe5cba214a
SSDEEP

768:WmmBY3PRxjQ+DU3ac7cqbU/bMQd50cRMlDVDWyaclOoHLh6Q2GbcgAGO:WmmBqwac7cqUA8RMlDVa3coikQ2HmO

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1552-59-0x0000000000400000-0x0000000000449000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1552 set thread context of 1748	1552	a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe	26

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1552	a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe
1748	a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1748	1552	a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe	26
PID 1552 wrote to memory of 1748	1552	a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe	26
PID 1552 wrote to memory of 1748	1552	a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe	26
PID 1552 wrote to memory of 1748	1552	a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe	26
PID 1552 wrote to memory of 1748	1552	a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe	26
PID 1552 wrote to memory of 1748	1552	a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe	26
PID 1552 wrote to memory of 1748	1552	a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe	26
PID 1552 wrote to memory of 1748	1552	a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe	26
PID 1552 wrote to memory of 1748	1552	a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe	26

C:\Users\Admin\AppData\Local\Temp\a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe
"C:\Users\Admin\AppData\Local\Temp\a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Local\Temp\a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe
  C:\Users\Admin\AppData\Local\Temp\a97de3ee048e09be3c2fc73cf749fe8886caf50777519bd916d05e82a0408fc5.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1748

memory/1552-59-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1748-56-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1748-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1748-63-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download