032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778

Analysis

max time kernel
142s
max time network
180s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 03:14

Target

032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe
Size

98KB
MD5

e55a4ed116d52a7593e2e342b11de385
SHA1

d977c708fed2f928e931c38069eaf40a891b97cd
SHA256

032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778
SHA512

83adbc76de34265a061546d27f37f790dd6e13c36fe4c156d42c06fd84acbcbaf4c175c29816ddab9b97c844ef21eee4d0a099a21670877edd0e60241af619bd
SSDEEP

3072:PxCqMph5A6rYr2ITh0ralM4GgMYqUCVYs:StA6UijraaGM/UCms

Score

8^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1916-58-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1916-60-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1916-62-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1916-65-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1916-66-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1916-67-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 888 set thread context of 1916	888	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe	27

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
888	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe
1916	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe
1916	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe
1916	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe
1916	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
888	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 1916	888	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe	27
PID 888 wrote to memory of 1916	888	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe	27
PID 888 wrote to memory of 1916	888	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe	27
PID 888 wrote to memory of 1916	888	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe	27
PID 888 wrote to memory of 1916	888	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe	27
PID 888 wrote to memory of 1916	888	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe	27
PID 888 wrote to memory of 1916	888	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe	27
PID 888 wrote to memory of 1916	888	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe	27
PID 888 wrote to memory of 1916	888	032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe	27

C:\Users\Admin\AppData\Local\Temp\032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe
"C:\Users\Admin\AppData\Local\Temp\032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888
- C:\Users\Admin\AppData\Local\Temp\032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe
  C:\Users\Admin\AppData\Local\Temp\032c08d5fb67fe136eda1cf3b629130bbc1150c19d13351a5b69a9fad5217778.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916

memory/888-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/888-61-0x00000000004F0000-0x00000000004F4000-memory.dmp

Filesize
16KB

Download
memory/1916-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/1916-57-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1916-58-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1916-60-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1916-63-0x0000000000408A60-mapping.dmp

Download
memory/1916-62-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1916-65-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1916-66-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1916-67-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download