3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f

Analysis

max time kernel
151s
max time network
160s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 10:16

Target

3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe
Size

94KB
MD5

d4ab285f2e9d9cf6cfd259a6d97a73b2
SHA1

91b15043a564edd0707a3318d93dd1a4d8ee7beb
SHA256

3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f
SHA512

bf4f79026b5f1bdf388ef53ce5e1ddb58ed0bd6682d4e928408152c10be4eb72994d1be670c38d2d6abca33c6527a9bf9b0ada14ba653b9040064521b4bad176
SSDEEP

1536:R2uVtHmBzsS6eBI3mgPWsFWfSZDYbOY88myU68PXKUfOAdpPmve6Ic:cM0oOBI3m6upbiPX/OkSr1

Score

8^/10

upx

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/860-58-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/860-61-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/860-62-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/860-64-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/860-66-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/860-68-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/860-67-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/860-69-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 860	1712	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe	27

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1712	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe
860	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe
860	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe
860	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe
860	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe
860	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1712	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 860	1712	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe	27
PID 1712 wrote to memory of 860	1712	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe	27
PID 1712 wrote to memory of 860	1712	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe	27
PID 1712 wrote to memory of 860	1712	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe	27
PID 1712 wrote to memory of 860	1712	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe	27
PID 1712 wrote to memory of 860	1712	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe	27
PID 1712 wrote to memory of 860	1712	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe	27
PID 1712 wrote to memory of 860	1712	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe	27
PID 1712 wrote to memory of 860	1712	3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe	27

C:\Users\Admin\AppData\Local\Temp\3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe
"C:\Users\Admin\AppData\Local\Temp\3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe
  "C:\Users\Admin\AppData\Local\Temp\3d071b8f6b94fcc91dada1d10c448b300a412eda59c42f6efcdcb775e4a9c63f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:860

memory/860-62-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/860-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/860-57-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/860-58-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/860-61-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/860-64-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/860-66-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/860-68-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/860-67-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/860-69-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1712-59-0x00000000002F0000-0x00000000002F4000-memory.dmp

Filesize
16KB

Download
memory/1712-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download