cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3

Analysis

max time kernel
170s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 22:40

Target

cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe
Size

72KB
MD5

606f30b04419e844ab6e5943403815be
SHA1

d40603e1c2e8b3250446d5d31c149c9898f8ab71
SHA256

cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3
SHA512

3668da2184a219cbcca9cca04f737a43e21f00f20f99ea2221d88f42af1331b34ddee340dcf616cee7284a80d596043ebb4ba84d307288d00552b848048c623c
SSDEEP

1536:OCiZimNXTx64q77WWGqMmAz6Vhikh/AH1JLmh/aK:OCgNjx6d7pvwahph/Ao

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/556-133-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/556-136-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/556-137-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/556-138-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1436 set thread context of 556	1436	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1436	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe
1436	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1436	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe
1436	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 556	1436	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	81
PID 1436 wrote to memory of 556	1436	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	81
PID 1436 wrote to memory of 556	1436	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	81
PID 1436 wrote to memory of 556	1436	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	81
PID 1436 wrote to memory of 556	1436	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	81
PID 1436 wrote to memory of 556	1436	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	81
PID 1436 wrote to memory of 556	1436	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	81
PID 1436 wrote to memory of 556	1436	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	81
PID 1436 wrote to memory of 556	1436	cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe	81

C:\Users\Admin\AppData\Local\Temp\cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe
"C:\Users\Admin\AppData\Local\Temp\cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Local\Temp\cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe
  C:\Users\Admin\AppData\Local\Temp\cb12ae31d2b0cd95b34daa72a7be417843f1ad482bff53efeb10b831287d75e3.exe
  2⤵
  PID:556

memory/556-133-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/556-136-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/556-137-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/556-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1436-134-0x0000000002340000-0x0000000002344000-memory.dmp

Filesize
16KB

Download