ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2022 16:35

Target

ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe
Size

65KB
MD5

908223e4785e9c6a588b9a03c4268479
SHA1

a65fbc42bd08c6458c61f5c7f1fb4a07bf728cb9
SHA256

ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae
SHA512

4e0db5cfb738ead0eb74f99a26365c30dc89587f56ef84afdc285b6d4afb10a7b1b463eb28c4ee6cb31b35a7168b0f0368edbd5515ed2a90541d2a49455793a8
SSDEEP

1536:tLNNkz6wes2nKcUBb/y5u8qaXLofs7SlyWycM9Oui4V0:djkzHtzBbK5DqaXLh79jFc4V0

Score

8^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3780-133-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/1984-134-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/3780-137-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3780-138-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/3780-139-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/3780-140-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1984 set thread context of 3780	1984	ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1984	ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe
1984	ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1984	ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 3780	1984	ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe	83
PID 1984 wrote to memory of 3780	1984	ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe	83
PID 1984 wrote to memory of 3780	1984	ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe	83
PID 1984 wrote to memory of 3780	1984	ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe	83
PID 1984 wrote to memory of 3780	1984	ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe	83
PID 1984 wrote to memory of 3780	1984	ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe	83
PID 1984 wrote to memory of 3780	1984	ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe	83
PID 1984 wrote to memory of 3780	1984	ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe	83
PID 1984 wrote to memory of 3780	1984	ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe	83

C:\Users\Admin\AppData\Local\Temp\ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe
"C:\Users\Admin\AppData\Local\Temp\ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe
  C:\Users\Admin\AppData\Local\Temp\ea189d6fe17cc5ee84a11177b8f1c91f8fe5abe3667530ed5b76eefe318ff5ae.exe
  2⤵
  PID:3780

memory/1984-134-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1984-136-0x0000000002170000-0x0000000002174000-memory.dmp

Filesize
16KB

Download
memory/3780-132-0x0000000000000000-mapping.dmp

Download
memory/3780-133-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/3780-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3780-138-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/3780-139-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/3780-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download