2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd

Analysis

max time kernel
6s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 16:37

Target

2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe
Size

221KB
MD5

78665865671ffcc1874e6a6e34890b9e
SHA1

31e1977f52d63970d71bee887ebb7d3ed79eaa66
SHA256

2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd
SHA512

5ee32420bab49469156e19ce6b1495dfe8005ec6310074da1029ce3e32f71e2f42a92cc0c48042e9f16875ca75ee2c8ad13b1c4d7180ea871e26cc4fdfe74701
SSDEEP

6144:v7/nyUDGQP/HydUYTwTTiMHzcefo7jtnTxxEeGvbCoS0g:T/RDVTY0T3tfo/tnTqvWoS0g

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/552-56-0x0000000000400000-0x00000000004F2000-memory.dmp	upx
behavioral1/memory/552-67-0x0000000000400000-0x00000000004F2000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 552 set thread context of 1932	552	2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe	27

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	552	2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe
Token: SeShutdownPrivilege	552	2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe
Token: SeShutdownPrivilege	552	2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
552	2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1932	552	2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe	27
PID 552 wrote to memory of 1932	552	2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe	27
PID 552 wrote to memory of 1932	552	2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe	27
PID 552 wrote to memory of 1932	552	2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe	27
PID 552 wrote to memory of 1932	552	2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe	27
PID 552 wrote to memory of 1932	552	2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe	27
PID 552 wrote to memory of 1932	552	2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe	27
PID 552 wrote to memory of 1932	552	2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe	27
PID 552 wrote to memory of 1932	552	2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe	27

C:\Users\Admin\AppData\Local\Temp\2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe
"C:\Users\Admin\AppData\Local\Temp\2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe
  "C:\Users\Admin\AppData\Local\Temp\2ad38d6cf3068b2c51f14d28a069c05bdac2f6cca9e30967b9635f291a18f0dd.exe"
  2⤵
  PID:1932

memory/552-56-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/552-67-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1932-57-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1932-60-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1932-58-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1932-61-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1932-63-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1932-66-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/1932-68-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download