7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 07:35

Target

7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe
Size

188KB
MD5

59715514dd3615912eb38bd3b95247c0
SHA1

33f1f5157fe785b33784d726f390b6c8b1163bbd
SHA256

7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9
SHA512

3ba2a8e310ee8527f22e1311e77f76f941aadd4d80c247a4b6a13bbafd53ab189aeb3da9d754cfa4ddb19a426f3e11dcf9f009e913d06b6a2dd1254fc796563b
SSDEEP

3072:FDe9us6uMqqDa/mPRRBWR+NN9Q+Wr8UrIyAL9tfyNy:FDeIPFqqDGz+NPQnt8yUfv

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4276-133-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4276-135-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4276-136-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4276-137-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4276-138-0x0000000000400000-0x000000000043B000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3740 set thread context of 4276	3740	7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe	79

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 4276	3740	7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe	79
PID 3740 wrote to memory of 4276	3740	7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe	79
PID 3740 wrote to memory of 4276	3740	7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe	79
PID 3740 wrote to memory of 4276	3740	7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe	79
PID 3740 wrote to memory of 4276	3740	7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe	79

C:\Users\Admin\AppData\Local\Temp\7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe
"C:\Users\Admin\AppData\Local\Temp\7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Users\Admin\AppData\Local\Temp\7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe
  "C:\Users\Admin\AppData\Local\Temp\7cadc54a836c43461b635ed395699b1b928fafd8ffcb386d3f8b761bd2db8dd9.exe"
  2⤵
  PID:4276

memory/3740-134-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4276-133-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4276-135-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4276-136-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4276-137-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4276-138-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download