a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3

Analysis

max time kernel
36s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 00:19

Target

a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe
Size

34KB
MD5

0e839fd362468e6beabac89c02f341b0
SHA1

e9c841d44d7ea0e4e46a52d6130c6c2bbb23634a
SHA256

a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3
SHA512

04897ed29defc1a80d67dbb30eeb2f73e95d3504b880ef6aecb60e2c24bd831bd8bafdc7dbd27282efce0f101fff6055420afd49859a7e56aa6f61b84b88a331
SSDEEP

768:voKzaGs83Ty0nJKpYMi3wp9CvD3kr/nbcuyD7UTsOKBdfI:keJKpRi3wCvDqnouy8AFdfI

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1968-55-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1968-57-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
976	svchost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1968	a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe
1968	a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 976	1968	a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe	20
PID 1968 wrote to memory of 976	1968	a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe	20
PID 1968 wrote to memory of 976	1968	a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe	20
PID 1968 wrote to memory of 976	1968	a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe	20

C:\Users\Admin\AppData\Local\Temp\a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe
"C:\Users\Admin\AppData\Local\Temp\a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\syswow64\svchost.exe
  "C:\Windows\syswow64\svchost.exe"
  2⤵
  - Deletes itself
  PID:976

memory/976-61-0x0000000000080000-0x0000000000083000-memory.dmp

Filesize
12KB

Download
memory/976-60-0x0000000000ED0000-0x0000000000ED8000-memory.dmp

Filesize
32KB

Download
memory/976-62-0x0000000000080000-0x0000000000083000-memory.dmp

Filesize
12KB

Download
memory/1968-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1968-55-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1968-57-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1968-59-0x0000000000420000-0x0000000000523000-memory.dmp

Filesize
1.0MB

Download