a87805a7a6f53809b1a71780511a0847d1cfc4e58c5aa8789147e403d2bc0a4e

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 22:00

Target

a87805a7a6f53809b1a71780511a0847d1cfc4e58c5aa8789147e403d2bc0a4e.exe
Size

132KB
MD5

916cd6625df13064a71fb8c18c60f040
SHA1

9390ada7dfae287a63f61d60992a291f6f9eded8
SHA256

a87805a7a6f53809b1a71780511a0847d1cfc4e58c5aa8789147e403d2bc0a4e
SHA512

a98d86019d685ba8c5875c79914181f05954e0c8b1f977ed7279b7f7d9e6388d9d87e49a76fd45c51b615490ced64ccd33c0bd26146008e20bd86f04598fa0fb
SSDEEP

3072:TOBWeScYolbkLy1I+W5/LA2N5lOMUjzPUDV/s:qBWeVYoNk+KJ8rMU8D2

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1344-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1344-60-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1344-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1344-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1344-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1344	a87805a7a6f53809b1a71780511a0847d1cfc4e58c5aa8789147e403d2bc0a4e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1344	1204	a87805a7a6f53809b1a71780511a0847d1cfc4e58c5aa8789147e403d2bc0a4e.exe	27
PID 1204 wrote to memory of 1344	1204	a87805a7a6f53809b1a71780511a0847d1cfc4e58c5aa8789147e403d2bc0a4e.exe	27
PID 1204 wrote to memory of 1344	1204	a87805a7a6f53809b1a71780511a0847d1cfc4e58c5aa8789147e403d2bc0a4e.exe	27
PID 1204 wrote to memory of 1344	1204	a87805a7a6f53809b1a71780511a0847d1cfc4e58c5aa8789147e403d2bc0a4e.exe	27

C:\Users\Admin\AppData\Local\Temp\a87805a7a6f53809b1a71780511a0847d1cfc4e58c5aa8789147e403d2bc0a4e.exe
"C:\Users\Admin\AppData\Local\Temp\a87805a7a6f53809b1a71780511a0847d1cfc4e58c5aa8789147e403d2bc0a4e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\a87805a7a6f53809b1a71780511a0847d1cfc4e58c5aa8789147e403d2bc0a4e.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1344

memory/1204-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1344-56-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1344-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1344-60-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1344-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1344-62-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1344-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1344-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download