00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 02:33

Target

00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe
Size

944KB
MD5

ca96fbdcb5c980e33d4745f8c04748f5
SHA1

95efc4193bb6d91bb7ec981c61946e2c431618fa
SHA256

00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd
SHA512

7acf2b7a12b84161d490868b0f006844d536e433bec446231f83559779fed4e3dfe1925ed7dd25fa2fe67e2866922e11214e832a824359b86d9e48f5683192da
SSDEEP

24576:tsBDCSgDlBtGGGypg0Oz0vgYAGxOPTGOaHGxaOnjSl3/:keRzDDwaHG0Osv

Score

8^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1148-56-0x0000000000400000-0x000000000063E000-memory.dmp	upx
behavioral1/memory/1148-58-0x0000000000400000-0x000000000063E000-memory.dmp	upx
behavioral1/memory/1148-59-0x0000000000400000-0x000000000063E000-memory.dmp	upx
behavioral1/memory/1148-62-0x0000000000400000-0x000000000063E000-memory.dmp	upx
behavioral1/memory/1148-64-0x0000000000400000-0x000000000063E000-memory.dmp	upx
behavioral1/memory/1148-65-0x0000000000400000-0x000000000063E000-memory.dmp	upx
behavioral1/memory/1148-66-0x0000000000400000-0x000000000063E000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1308 set thread context of 1148	1308	00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1308	00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe
1308	00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1148	1308	00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe	27
PID 1308 wrote to memory of 1148	1308	00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe	27
PID 1308 wrote to memory of 1148	1308	00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe	27
PID 1308 wrote to memory of 1148	1308	00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe	27
PID 1308 wrote to memory of 1148	1308	00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe	27
PID 1308 wrote to memory of 1148	1308	00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe	27
PID 1308 wrote to memory of 1148	1308	00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe	27
PID 1308 wrote to memory of 1148	1308	00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe	27

C:\Users\Admin\AppData\Local\Temp\00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe
"C:\Users\Admin\AppData\Local\Temp\00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe
  C:\Users\Admin\AppData\Local\Temp\00571cf21b26c483f49709a2fc49f9f5dfded698fd834f61cf8a93b859f741dd.exe
  2⤵
  PID:1148

memory/1148-55-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1148-56-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1148-58-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1148-59-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1148-62-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1148-64-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1148-65-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1148-66-0x0000000000400000-0x000000000063E000-memory.dmp

Filesize
2.2MB

Download
memory/1308-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1308-61-0x00000000002D0000-0x00000000002D4000-memory.dmp

Filesize
16KB

Download