eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d

Analysis

max time kernel
4s
max time network
82s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 06:07

Target

eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe
Size

98KB
MD5

20c3269723fe469e1e30116cee6e5bb3
SHA1

5d1b5df3151b09dc0c31e1ddef8f4879a2b154c9
SHA256

eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d
SHA512

11a37c054f9e494b8544c18669b072bc7b2d4fed15cff7e2e1424522077ea4495b11913b59ddb6655a02ffaecca9d14a77b712b40a2658294d5785b2084d7804
SSDEEP

1536:YExIjqMT9h5iXH6rYr2BK3zF2aIT7eObr5wLkmq8LZcygHZiptBJ0S:5xCqMph5A6rYr2I3R/G7vfA4HKBJT

Score

8^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/548-58-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/548-60-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/548-61-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/548-66-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/548-65-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/548-67-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/548-68-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 968 set thread context of 548	968	eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
968	eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
968	eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 548	968	eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe	27
PID 968 wrote to memory of 548	968	eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe	27
PID 968 wrote to memory of 548	968	eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe	27
PID 968 wrote to memory of 548	968	eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe	27
PID 968 wrote to memory of 548	968	eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe	27
PID 968 wrote to memory of 548	968	eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe	27
PID 968 wrote to memory of 548	968	eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe	27
PID 968 wrote to memory of 548	968	eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe	27
PID 968 wrote to memory of 548	968	eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe	27

C:\Users\Admin\AppData\Local\Temp\eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe
"C:\Users\Admin\AppData\Local\Temp\eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968
- C:\Users\Admin\AppData\Local\Temp\eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe
  C:\Users\Admin\AppData\Local\Temp\eaf674a255e71536813f07f32558134ef5359e3172a10a77f719b0532e469a2d.exe
  2⤵
  PID:548

memory/548-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/548-57-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/548-58-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/548-60-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/548-61-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/548-66-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/548-65-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/548-67-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/548-68-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/968-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/968-63-0x0000000000280000-0x0000000000284000-memory.dmp

Filesize
16KB

Download