e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 21:57

Target

e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe
Size

240KB
MD5

0abe74ad896f43d5a5872506c63bf81f
SHA1

6bd0301981b42f509ca40f7aa341227e1f389902
SHA256

e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744
SHA512

89bbaa565a05a94b18959cbb6de4b3b160ef2cda280715dd5ffaab3e147e4e0e096dab5d487f9f868b764ccfde782a5c23efd8a5d15b0bcf5d25d32fdac4de1f
SSDEEP

6144:0RL7V/sBI2xqlMutSbkCpguZuqThPcV4JDkKIDeHg1CgpmE8eP:0RLR/sBI2xqlabkCgukqFPcVgAtSHg1D

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1980-54-0x0000000000400000-0x0000000000451000-memory.dmp	upx
behavioral1/memory/1980-63-0x0000000000400000-0x0000000000451000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 1756	1980	e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1472	1756	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1756	e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1756	1980	e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe	28
PID 1980 wrote to memory of 1756	1980	e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe	28
PID 1980 wrote to memory of 1756	1980	e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe	28
PID 1980 wrote to memory of 1756	1980	e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe	28
PID 1980 wrote to memory of 1756	1980	e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe	28
PID 1980 wrote to memory of 1756	1980	e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe	28
PID 1980 wrote to memory of 1756	1980	e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe	28
PID 1980 wrote to memory of 1756	1980	e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe	28
PID 1756 wrote to memory of 1472	1756	e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe	29
PID 1756 wrote to memory of 1472	1756	e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe	29
PID 1756 wrote to memory of 1472	1756	e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe	29
PID 1756 wrote to memory of 1472	1756	e158c4a3c9a4ab5b71890a431a7ff9af52c047fe6183f2873690666cf487c744.exe	29

memory/1756-67-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1756-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-58-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1980-54-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1980-63-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download