f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 09:18

Target

f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb.exe
Size

121KB
MD5

0d1dfa7b0b9ddafef0c960f8539eb9e4
SHA1

d11e118a15b0aec96b2a43f5b3bf1b8dbb12188f
SHA256

f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb
SHA512

a6d61cbbf7c458b30f4d86995e81fd9724ec7d8acca7d31fd6aea4a4a1f223917f39489ec593f2afbadcc458b19db22da34e821ad2dbd48edd7a93283807c87b
SSDEEP

3072:Le2rhIskMbjqKmnouqjhdCRp5Jyh9EHy6s3qPp:FSg+Oij58iC3

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1608-132-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/memory/1608-138-0x0000000000400000-0x0000000000430000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1608 set thread context of 5028	1608	f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb.exe	81

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 5028	1608	f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb.exe	81
PID 1608 wrote to memory of 5028	1608	f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb.exe	81
PID 1608 wrote to memory of 5028	1608	f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb.exe	81
PID 1608 wrote to memory of 5028	1608	f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb.exe	81
PID 1608 wrote to memory of 5028	1608	f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb.exe	81
PID 1608 wrote to memory of 5028	1608	f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb.exe	81
PID 1608 wrote to memory of 5028	1608	f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb.exe	81
PID 1608 wrote to memory of 5028	1608	f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb.exe	81

C:\Users\Admin\AppData\Local\Temp\f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb.exe
"C:\Users\Admin\AppData\Local\Temp\f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb.exe
  "C:\Users\Admin\AppData\Local\Temp\f8ecc5432d390e92eef5e372dc3d21f0925c22a6cbb2efe59649f4ca6a40dbbb.exe"
  2⤵
  PID:5028

memory/1608-132-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1608-138-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/5028-134-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5028-135-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5028-136-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5028-139-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download