cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3

Analysis

max time kernel
143s
max time network
161s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 22:40

Target

cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe
Size

72KB
MD5

606f30b04419e844ab6e5943403815be
SHA1

d40603e1c2e8b3250446d5d31c149c9898f8ab71
SHA256

cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3
SHA512

3668da2184a219cbcca9cca04f737a43e21f00f20f99ea2221d88f42af1331b34ddee340dcf616cee7284a80d596043ebb4ba84d307288d00552b848048c623c
SSDEEP

1536:OCiZimNXTx64q77WWGqMmAz6Vhikh/AH1JLmh/aK:OCgNjx6d7pvwahph/Ao

Score

8^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1204-58-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1204-60-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1204-62-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1204-65-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1204-66-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1204-67-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/1204-68-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1884 set thread context of 1204	1884	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1884	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1884	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe
1884	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1204	1884	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	28
PID 1884 wrote to memory of 1204	1884	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	28
PID 1884 wrote to memory of 1204	1884	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	28
PID 1884 wrote to memory of 1204	1884	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	28
PID 1884 wrote to memory of 1204	1884	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	28
PID 1884 wrote to memory of 1204	1884	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	28
PID 1884 wrote to memory of 1204	1884	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	28
PID 1884 wrote to memory of 1204	1884	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	28
PID 1884 wrote to memory of 1204	1884	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	28

C:\Users\Admin\AppData\Local\Temp\cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe
"C:\Users\Admin\AppData\Local\Temp\cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe
  C:\Users\Admin\AppData\Local\Temp\cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe
  2⤵
  PID:1204

memory/1204-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/1204-57-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1204-58-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1204-60-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1204-62-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1204-65-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1204-66-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1204-67-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1204-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1884-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1884-61-0x00000000005C0000-0x00000000005C4000-memory.dmp

Filesize
16KB

Download