fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 15:15

Target

fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe
Size

72KB
MD5

6d92c0faed22fbc12c10246511986d40
SHA1

c84fddc0c61da2ac8d5431ab5d24450c797cea62
SHA256

fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48
SHA512

d579ce19bdd4ce0569ff116b4b31f103416ce320d0906fb94b90d5ef7a0496e1e435b1228670cfa852688f2b5fa952d6be7f27dd0a3e077059ebbbb904a139bd
SSDEEP

1536:GClZ2R9XTI9u3xHU8FyEvNgJW+1w8kq2/7CGr:GCw9jIQ39HFrlgo+1rkquCq

Score

8^/10

upx

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1056-58-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1056-61-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1056-62-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1056-65-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1056-66-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/1056-67-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1056-68-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/1056-69-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1816 set thread context of 1056	1816	fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1816	fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1816	fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe
1816	fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1056	1816	fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe	27
PID 1816 wrote to memory of 1056	1816	fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe	27
PID 1816 wrote to memory of 1056	1816	fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe	27
PID 1816 wrote to memory of 1056	1816	fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe	27
PID 1816 wrote to memory of 1056	1816	fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe	27
PID 1816 wrote to memory of 1056	1816	fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe	27
PID 1816 wrote to memory of 1056	1816	fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe	27
PID 1816 wrote to memory of 1056	1816	fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe	27
PID 1816 wrote to memory of 1056	1816	fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe	27

C:\Users\Admin\AppData\Local\Temp\fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe
"C:\Users\Admin\AppData\Local\Temp\fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe
  C:\Users\Admin\AppData\Local\Temp\fd6912b5bbc1017660433ea4dfb950189c825105776d90b4e4a4e0a42dd64a48.exe
  2⤵
  PID:1056

memory/1056-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1056-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/1056-57-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1056-58-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1056-61-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1056-62-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1056-65-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1056-67-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1056-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1056-69-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1816-59-0x00000000003C0000-0x00000000003C4000-memory.dmp

Filesize
16KB

Download
memory/1816-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download