be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 16:17

Target

be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe
Size

65KB
MD5

02505664038fb0d5acca7a9b9b6b5340
SHA1

df19eaf5f114deeefbe1ff67a372907ddff16321
SHA256

be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed
SHA512

be9b03692b90b0a7690585acbcf967fe93e6c06cd0c66a7c0714705e2474b80b3dd2028d3f179450a815edebcae8a0c4d884df19090ebb090fd0daacc4b0d214
SSDEEP

1536:rTWNKznY8lHgnVr5X4LvRQBvm/3DM0TWFwVrSSR3e+f:HkKznjHgn5KL6B0I0T8wVrSS3eI

Score

8^/10

upx

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1768-55-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/1332-61-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1332-63-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1332-64-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1332-68-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1332-69-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/1332-70-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1332-71-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1768 set thread context of 1332	1768	be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1768	be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1768	be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1332	1768	be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe	27
PID 1768 wrote to memory of 1332	1768	be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe	27
PID 1768 wrote to memory of 1332	1768	be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe	27
PID 1768 wrote to memory of 1332	1768	be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe	27
PID 1768 wrote to memory of 1332	1768	be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe	27
PID 1768 wrote to memory of 1332	1768	be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe	27
PID 1768 wrote to memory of 1332	1768	be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe	27
PID 1768 wrote to memory of 1332	1768	be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe	27
PID 1768 wrote to memory of 1332	1768	be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe	27

C:\Users\Admin\AppData\Local\Temp\be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe
"C:\Users\Admin\AppData\Local\Temp\be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Local\Temp\be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe
  C:\Users\Admin\AppData\Local\Temp\be02d1c5feeae1224940f53287527ca029ee8bb39735068a075fcfcb9b24e1ed.exe
  2⤵
  PID:1332

memory/1332-64-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1332-63-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1332-57-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/1332-71-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1332-70-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1332-60-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1332-69-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1332-61-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1332-68-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1768-65-0x00000000002D0000-0x00000000002D4000-memory.dmp

Filesize
16KB

Download
memory/1768-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1768-55-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1768-59-0x0000000000390000-0x00000000003A0000-memory.dmp

Filesize
64KB

Download
memory/1768-56-0x00000000002C0000-0x00000000002D0000-memory.dmp

Filesize
64KB

Download