53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 23:35

Target

53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe
Size

96KB
MD5

0953e214b4fd4cb96c675a36d17a999f
SHA1

0fe98a876b1eaf95d8495d2b3832f042560ee098
SHA256

53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e
SHA512

9a42cff59e86174d1bdb04e99acfdb6653da396599c0f0bb3e2e9d81f1c8387e70cb82e66e1a4d573efa4e582dfe4b68b8e6fc8835b6d790d6be91ad9ff60707
SSDEEP

1536:+7Fh0hhDf4LHQOvsAE26LU8Bu/F9yIimHe3ZBkt11Z5cKjpnQGE76QEW:n7DfSEAE26w8AfyIg3f4Z5fVQdGW

Score

8^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2156-133-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/2156-136-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/2156-137-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/2156-138-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/2156-139-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/2156-140-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 400 set thread context of 2156	400	53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
400	53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe
400	53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
400	53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe
400	53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 2156	400	53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe	82
PID 400 wrote to memory of 2156	400	53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe	82
PID 400 wrote to memory of 2156	400	53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe	82
PID 400 wrote to memory of 2156	400	53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe	82
PID 400 wrote to memory of 2156	400	53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe	82
PID 400 wrote to memory of 2156	400	53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe	82
PID 400 wrote to memory of 2156	400	53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe	82
PID 400 wrote to memory of 2156	400	53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe	82
PID 400 wrote to memory of 2156	400	53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe	82

C:\Users\Admin\AppData\Local\Temp\53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe
"C:\Users\Admin\AppData\Local\Temp\53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400
- C:\Users\Admin\AppData\Local\Temp\53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe
  C:\Users\Admin\AppData\Local\Temp\53ab4f819383e4df438c12a04b357589a2d11ecc44d82ebd60b71a8394f8ad7e.exe
  2⤵
  PID:2156

memory/400-134-0x0000000002320000-0x0000000002324000-memory.dmp

Filesize
16KB

Download
memory/2156-133-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2156-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2156-137-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2156-138-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2156-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2156-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download