51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054

Analysis

max time kernel
117s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 10:35

Target

51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe
Size

211KB
MD5

8b80d97fc55bbaf025aa0ac7adef8c1a
SHA1

9ea8be2e0345ef7cf8eca196370ed26d6ac70cc8
SHA256

51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054
SHA512

f91ed29cb7f8c90f585f63e6a32abde942207106836105dd5e2b0619e9c9bd50e2d9d04fa173548a8d3df28d108a2d793bbe546ec765b1eeb9266cf2a8c8b954
SSDEEP

3072:C2WnGpHvRREuggPJiS/5BJ5KVqn6iVS/cwZ7DJe2qow1t2nbHffukJAQWgJpRu:6wpKJgAc5SUwZ78BR2nbH3uPQxJLu

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4976-133-0x0000000000400000-0x000000000044C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe

description	pid	process	target process
PID 1664 set thread context of 4976	1664	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe

pid process

1664 51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe

pid	process
1664	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe

description	pid	process	target process
PID 1664 wrote to memory of 4976	1664	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe
PID 1664 wrote to memory of 4976	1664	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe
PID 1664 wrote to memory of 4976	1664	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe
PID 1664 wrote to memory of 4976	1664	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe
PID 1664 wrote to memory of 4976	1664	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe
PID 1664 wrote to memory of 4976	1664	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe
PID 1664 wrote to memory of 4976	1664	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe	51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe

C:\Users\Admin\AppData\Local\Temp\51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe
"C:\Users\Admin\AppData\Local\Temp\51e37fe405b41c15560ac52bb317c8239504eb4bf200c16b6289bfda30480054.exe"
2⤵
PID:4976

memory/4976-132-0x0000000000000000-mapping.dmp

Download
memory/4976-133-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download