84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e

Analysis

max time kernel
150s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 06:57

Target

84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe
Size

96KB
MD5

8504842c6374d5d33894771bb6ecdfca
SHA1

d4b847c1e2f920233e817acab5a0a7ac65c0d7da
SHA256

84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e
SHA512

92175cc0a0a831b7e3920a706591baa9d5fd65e162e21ca54eeefd2a38e50ab6a572bcaac144cdfcee1518b2783a47635ef58ec0a5f67d11ba6837b1e021f239
SSDEEP

1536:HIFh0hhDf4LHiYHm1U2hahfLVwfEhNGRiPAmrzQ+hDTpo:f7Df6G1U2hkxwj0rLpT6

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2164-133-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/2164-136-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/2164-138-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/2164-137-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/2164-139-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3776 set thread context of 2164	3776	84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3776	84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe
3776	84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3776	84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe
3776	84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 2164	3776	84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe	81
PID 3776 wrote to memory of 2164	3776	84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe	81
PID 3776 wrote to memory of 2164	3776	84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe	81
PID 3776 wrote to memory of 2164	3776	84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe	81
PID 3776 wrote to memory of 2164	3776	84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe	81
PID 3776 wrote to memory of 2164	3776	84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe	81
PID 3776 wrote to memory of 2164	3776	84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe	81
PID 3776 wrote to memory of 2164	3776	84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe	81
PID 3776 wrote to memory of 2164	3776	84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe	81

C:\Users\Admin\AppData\Local\Temp\84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe
"C:\Users\Admin\AppData\Local\Temp\84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Users\Admin\AppData\Local\Temp\84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe
  C:\Users\Admin\AppData\Local\Temp\84cd8e54beb31edf114c858417b654dd7afb4005adfb4c77d492e11f8e35197e.exe
  2⤵
  PID:2164

memory/2164-133-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2164-136-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2164-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2164-137-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2164-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3776-134-0x0000000000A80000-0x0000000000A84000-memory.dmp

Filesize
16KB

Download