5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2022 20:15

Target

5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe
Size

89KB
MD5

6fe7f7c42718ea6a283ae4329974e1d0
SHA1

2e40b09e0ce0be00b58a90ae676bc9e0e00b578a
SHA256

5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713
SHA512

dcf1cd7b0a519a6dc2fd561ea4625af3a6bfd19fc94d96f0ed91c4ca39cc7b663f1bc4b580a31dea043ce187154ad5c314d25aec9399b89cc66a5082edc58b2f
SSDEEP

1536:u5PEJEPoN7jyesU7gZtPLdb4E2h7s9SdalPtqEri:u5PElUfZtj94WSdyi

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2040-133-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/2040-136-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2040-137-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/2040-138-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/2040-139-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5044 set thread context of 2040	5044	5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe	85

Suspicious behavior: EnumeratesProcesses 16 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5044	5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 2040	5044	5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe	85
PID 5044 wrote to memory of 2040	5044	5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe	85
PID 5044 wrote to memory of 2040	5044	5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe	85
PID 5044 wrote to memory of 2040	5044	5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe	85
PID 5044 wrote to memory of 2040	5044	5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe	85
PID 5044 wrote to memory of 2040	5044	5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe	85
PID 5044 wrote to memory of 2040	5044	5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe	85
PID 5044 wrote to memory of 2040	5044	5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe	85
PID 5044 wrote to memory of 2040	5044	5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe	85

C:\Users\Admin\AppData\Local\Temp\5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe
"C:\Users\Admin\AppData\Local\Temp\5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe
  "C:\Users\Admin\AppData\Local\Temp\5a3d442ea8c19fbda25c76ba12d3e1038350b5853096239b42335b8b83ebc713.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2040

memory/2040-132-0x0000000000000000-mapping.dmp

Download
memory/2040-133-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2040-136-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2040-137-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2040-138-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2040-139-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5044-135-0x0000000000A70000-0x0000000000A74000-memory.dmp

Filesize
16KB

Download