ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b

Analysis

max time kernel
142s
max time network
167s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 06:15

Target

ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe
Size

64KB
MD5

06f0bf4e4378137991f5f8e400b7d370
SHA1

2345deb7babe9caeeeddf2596da4ecd3d678154b
SHA256

ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b
SHA512

4f8c84ec6d347ed078f4bcca854c3de192522c819d9453d5d46a63839d7079081b7b89d5dafd28ad18fd4bbe4c125c72c9cf51d3d37844bcbc68ce3a2aa5a7da
SSDEEP

1536:0x3NKXdbunBiJ8ExlYxyaZzH/QkDqSv4c25WnMlrb:S9KXdqn0bYxyaVHIKqSf2Pt

Score

8^/10

upx

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1932-54-0x0000000000400000-0x0000000000402000-memory.dmp	upx
behavioral1/memory/1932-59-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/896-63-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/896-65-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/896-66-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/896-69-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/896-70-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/896-71-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/896-72-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 896	1932	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1932	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1932	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 896	1932	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	28
PID 1932 wrote to memory of 896	1932	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	28
PID 1932 wrote to memory of 896	1932	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	28
PID 1932 wrote to memory of 896	1932	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	28
PID 1932 wrote to memory of 896	1932	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	28
PID 1932 wrote to memory of 896	1932	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	28
PID 1932 wrote to memory of 896	1932	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	28
PID 1932 wrote to memory of 896	1932	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	28
PID 1932 wrote to memory of 896	1932	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	28

C:\Users\Admin\AppData\Local\Temp\ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe
"C:\Users\Admin\AppData\Local\Temp\ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe
  C:\Users\Admin\AppData\Local\Temp\ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe
  2⤵
  PID:896

memory/896-69-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/896-66-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/896-56-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/896-72-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/896-71-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/896-70-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/896-65-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/896-63-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/896-58-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1932-61-0x00000000003D0000-0x00000000003D4000-memory.dmp

Filesize
16KB

Download
memory/1932-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1932-54-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1932-62-0x00000000004A0000-0x00000000004B0000-memory.dmp

Filesize
64KB

Download
memory/1932-60-0x00000000003C0000-0x00000000003D0000-memory.dmp

Filesize
64KB

Download
memory/1932-59-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download