af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-10-2022 23:40

Target

af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe
Size

52KB
MD5

654202c50c81d2b1f37a48df07817e5f
SHA1

81b135d6cb096415de8bb47fd0e9418d74123a0a
SHA256

af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac
SHA512

1f3c340543d22959d1e69339a719ffc4b315ceea861516ace9bcaa11a78f41c01f1483224a19bc8f327471d9ab9f5323c6f514a3f5cb7b253c55419ae7c2cf42
SSDEEP

768:IgimnSVvb1lKhn4wWtZxO5IcblsLObw6vTlpeY/Y0UCYinSY0xUf2vVaMb:Ii2vb1lK3WtnOq4isoaYr5QSd0Mb

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2032-59-0x0000000000400000-0x000000000042B000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 980	2032	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
980	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe
980	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2032	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 980	2032	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe	27
PID 2032 wrote to memory of 980	2032	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe	27
PID 2032 wrote to memory of 980	2032	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe	27
PID 2032 wrote to memory of 980	2032	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe	27
PID 2032 wrote to memory of 980	2032	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe	27
PID 2032 wrote to memory of 980	2032	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe	27
PID 2032 wrote to memory of 980	2032	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe	27
PID 2032 wrote to memory of 980	2032	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe	27
PID 980 wrote to memory of 1368	980	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe	12
PID 980 wrote to memory of 1368	980	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe	12
PID 980 wrote to memory of 1368	980	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe	12
PID 980 wrote to memory of 1368	980	af059b232cba4ee9e7586971bec430191cb20e479a72c8101d9f7c0f3703caac.exe	12

memory/980-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/980-57-0x0000000000407C89-mapping.dmp

Download
memory/980-60-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/980-61-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/980-65-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1368-62-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2032-59-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download