9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 16:02

Target

9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe
Size

72KB
MD5

9048cd7726dab651b28d93683c03c5d8
SHA1

30e86fa50bc8b11e48a4284440c7528d1f5b3a7e
SHA256

9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267
SHA512

8afe42f2e806d7c37df49b35e27cfc1a59544d4b673233694ffa1a90a0bd1816debc862537c9aab4e7c1efe814162b31ef9723b2adcfb30097fc322da9054558
SSDEEP

1536:jlSZ2R9XTIkjWNp5R5T+wJ4i/Uk/DtUOeCt4qN:jlj9jIeEpdQi/7/Dt5ZiqN

Score

8^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1096-133-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/1096-136-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/1096-137-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/1096-138-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/1096-139-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/1096-140-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4412 set thread context of 1096	4412	9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4412	9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe
4412	9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4412	9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe
4412	9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 1096	4412	9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe	81
PID 4412 wrote to memory of 1096	4412	9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe	81
PID 4412 wrote to memory of 1096	4412	9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe	81
PID 4412 wrote to memory of 1096	4412	9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe	81
PID 4412 wrote to memory of 1096	4412	9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe	81
PID 4412 wrote to memory of 1096	4412	9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe	81
PID 4412 wrote to memory of 1096	4412	9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe	81
PID 4412 wrote to memory of 1096	4412	9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe	81
PID 4412 wrote to memory of 1096	4412	9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe	81

C:\Users\Admin\AppData\Local\Temp\9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe
"C:\Users\Admin\AppData\Local\Temp\9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Users\Admin\AppData\Local\Temp\9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe
  C:\Users\Admin\AppData\Local\Temp\9618b6cf5e0ff939295d135f9f696e044237b93b5ec020e5efca5308e781e267.exe
  2⤵
  PID:1096

memory/1096-133-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1096-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1096-137-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1096-138-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1096-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1096-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4412-135-0x0000000000A20000-0x0000000000A24000-memory.dmp

Filesize
16KB

Download