7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 07:35

Target

7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe
Size

188KB
MD5

59715514dd3615912eb38bd3b95247c0
SHA1

33f1f5157fe785b33784d726f390b6c8b1163bbd
SHA256

7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9
SHA512

3ba2a8e310ee8527f22e1311e77f76f941aadd4d80c247a4b6a13bbafd53ab189aeb3da9d754cfa4ddb19a426f3e11dcf9f009e913d06b6a2dd1254fc796563b
SSDEEP

3072:FDe9us6uMqqDa/mPRRBWR+NN9Q+Wr8UrIyAL9tfyNy:FDeIPFqqDGz+NPQnt8yUfv

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1076-56-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1076-58-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1076-59-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1076-61-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1076-62-0x0000000000400000-0x000000000043B000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 1076	1488	7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe	26

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1076	1488	7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe	26
PID 1488 wrote to memory of 1076	1488	7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe	26
PID 1488 wrote to memory of 1076	1488	7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe	26
PID 1488 wrote to memory of 1076	1488	7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe	26
PID 1488 wrote to memory of 1076	1488	7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe	26
PID 1488 wrote to memory of 1076	1488	7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe	26

C:\Users\Admin\AppData\Local\Temp\7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe
"C:\Users\Admin\AppData\Local\Temp\7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe
  "C:\Users\Admin\AppData\Local\Temp\7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe"
  2⤵
  PID:1076

memory/1076-54-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1076-56-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1076-58-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1076-59-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1076-61-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1076-62-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1488-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download