0c43ef0dac1e28271d63631c9b3eb71881c09fd84b11ea860558a711cfb67b50

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 11:24

Target

0c43ef0dac1e28271d63631c9b3eb71881c09fd84b11ea860558a711cfb67b50.exe
Size

122KB
MD5

a36485da2724700f82138cecc2fee051
SHA1

ac23866b07abeb4b2848d49832fcb6d29453e6a4
SHA256

0c43ef0dac1e28271d63631c9b3eb71881c09fd84b11ea860558a711cfb67b50
SHA512

3d6b4a84ebc8d2b44b0853a583f4c1af1064168c28d7106345adacc73dba108543288ba6ff0251b4c1a6ca5ebef4baebfe6a4aa0dd445d8441a508db01d254be
SSDEEP

3072:aal0VwemYcZmKqK81duXs2vWEQSYAHuy4S1HXXWG/D:X0SHCAXTvWEQyHPFl7

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2016-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2016-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2016-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2016-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2016	0c43ef0dac1e28271d63631c9b3eb71881c09fd84b11ea860558a711cfb67b50.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2016	2024	0c43ef0dac1e28271d63631c9b3eb71881c09fd84b11ea860558a711cfb67b50.exe	27
PID 2024 wrote to memory of 2016	2024	0c43ef0dac1e28271d63631c9b3eb71881c09fd84b11ea860558a711cfb67b50.exe	27
PID 2024 wrote to memory of 2016	2024	0c43ef0dac1e28271d63631c9b3eb71881c09fd84b11ea860558a711cfb67b50.exe	27
PID 2024 wrote to memory of 2016	2024	0c43ef0dac1e28271d63631c9b3eb71881c09fd84b11ea860558a711cfb67b50.exe	27

C:\Users\Admin\AppData\Local\Temp\0c43ef0dac1e28271d63631c9b3eb71881c09fd84b11ea860558a711cfb67b50.exe
"C:\Users\Admin\AppData\Local\Temp\0c43ef0dac1e28271d63631c9b3eb71881c09fd84b11ea860558a711cfb67b50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Local\Temp\0c43ef0dac1e28271d63631c9b3eb71881c09fd84b11ea860558a711cfb67b50.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2016

memory/2016-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2016-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2016-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2016-63-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2016-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2024-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/2024-56-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download