ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b

Analysis

max time kernel
157s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 06:15

Target

ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe
Size

64KB
MD5

06f0bf4e4378137991f5f8e400b7d370
SHA1

2345deb7babe9caeeeddf2596da4ecd3d678154b
SHA256

ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b
SHA512

4f8c84ec6d347ed078f4bcca854c3de192522c819d9453d5d46a63839d7079081b7b89d5dafd28ad18fd4bbe4c125c72c9cf51d3d37844bcbc68ce3a2aa5a7da
SSDEEP

1536:0x3NKXdbunBiJ8ExlYxyaZzH/QkDqSv4c25WnMlrb:S9KXdqn0bYxyaVHIKqSf2Pt

Score

8^/10

upx

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2296-132-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/2296-133-0x0000000000400000-0x0000000000402000-memory.dmp	upx
behavioral2/memory/2296-137-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4992-135-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/4992-139-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/4992-140-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/4992-141-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/4992-142-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2296 set thread context of 4992	2296	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2296	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe
2296	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2296	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 4992	2296	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	81
PID 2296 wrote to memory of 4992	2296	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	81
PID 2296 wrote to memory of 4992	2296	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	81
PID 2296 wrote to memory of 4992	2296	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	81
PID 2296 wrote to memory of 4992	2296	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	81
PID 2296 wrote to memory of 4992	2296	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	81
PID 2296 wrote to memory of 4992	2296	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	81
PID 2296 wrote to memory of 4992	2296	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	81
PID 2296 wrote to memory of 4992	2296	ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe	81

C:\Users\Admin\AppData\Local\Temp\ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe
"C:\Users\Admin\AppData\Local\Temp\ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe
  C:\Users\Admin\AppData\Local\Temp\ccfd2958075e76665a110757bf2f8de117f264c569540cb63cfc42ab9912d67b.exe
  2⤵
  PID:4992

memory/2296-132-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2296-133-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2296-136-0x00000000023B0000-0x00000000023B4000-memory.dmp

Filesize
16KB

Download
memory/2296-137-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4992-135-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/4992-139-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/4992-140-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/4992-141-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4992-142-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download