f3c42c28d3931b12be72a924fbab22017f59d2744c7f53c39a079c034eb7f0d5

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 05:26

Target

HEUR-Trojan-Ransom.Win32.exe
Size

277KB
MD5

26fa913a18e039bef6170ac39ca9488d
SHA1

287a66c50b7927e05a235b6b76cc7e50ced4efc6
SHA256

f3c42c28d3931b12be72a924fbab22017f59d2744c7f53c39a079c034eb7f0d5
SHA512

97b7f84825f9f6ddec5519809ed929a50e35afd930c5d360b9b39b9069ebf8660f53e36543caf6849d6a016f690341604812591f60c8aacd5ec62e0be1114f2a
SSDEEP

6144:PKNlZbHsIrosc51Muk6tsxSwFhi2qNHef:ub5ros76tkSUhi2qQf

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/404-132-0x0000000000400000-0x000000000046F000-memory.dmp	upx
behavioral2/memory/404-133-0x0000000000400000-0x000000000046F000-memory.dmp	upx
behavioral2/memory/404-137-0x0000000000400000-0x000000000046F000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 404 set thread context of 1556	404	HEUR-Trojan-Ransom.Win32.exe	78

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 1556	404	HEUR-Trojan-Ransom.Win32.exe	78
PID 404 wrote to memory of 1556	404	HEUR-Trojan-Ransom.Win32.exe	78
PID 404 wrote to memory of 1556	404	HEUR-Trojan-Ransom.Win32.exe	78
PID 404 wrote to memory of 1556	404	HEUR-Trojan-Ransom.Win32.exe	78
PID 404 wrote to memory of 1556	404	HEUR-Trojan-Ransom.Win32.exe	78
PID 404 wrote to memory of 1556	404	HEUR-Trojan-Ransom.Win32.exe	78
PID 404 wrote to memory of 1556	404	HEUR-Trojan-Ransom.Win32.exe	78
PID 404 wrote to memory of 1556	404	HEUR-Trojan-Ransom.Win32.exe	78

C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.Win32.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.Win32.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:404
- C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.Win32.exe
  C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.Win32.exe
  2⤵
  PID:1556

memory/404-132-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/404-133-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/404-137-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1556-135-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1556-138-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1556-139-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download