59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8

Analysis

max time kernel
17s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 17:16

Target

59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe
Size

223KB
MD5

10ce0ffb64fb0fd7b7b8254e87a99d7d
SHA1

2807fd670e39eab5f69ead9d2bec87ce86c35f27
SHA256

59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8
SHA512

33f625fccdc07c26827d63cf3eb51dcd3fdf0eff3e85fe55ee06812002d85ea3379c62dfd786f41b2b5548c08dbed0aee5470b9bfeec6738911fb5a848bc032d
SSDEEP

6144:23zYvMMNE3N2Sg/ZJOMPtDuB/l2oYNUjoSL:IrQ1Sg8/NoSL

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1276-56-0x0000000000400000-0x00000000004F0000-memory.dmp	upx
behavioral1/memory/1276-66-0x0000000000400000-0x00000000004F0000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 944	1276	59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe	28

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1276	59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 944	1276	59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe	28
PID 1276 wrote to memory of 944	1276	59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe	28
PID 1276 wrote to memory of 944	1276	59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe	28
PID 1276 wrote to memory of 944	1276	59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe	28
PID 1276 wrote to memory of 944	1276	59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe	28
PID 1276 wrote to memory of 944	1276	59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe	28
PID 1276 wrote to memory of 944	1276	59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe	28
PID 1276 wrote to memory of 944	1276	59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe	28
PID 1276 wrote to memory of 944	1276	59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe	28

C:\Users\Admin\AppData\Local\Temp\59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe
"C:\Users\Admin\AppData\Local\Temp\59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe
  "C:\Users\Admin\AppData\Local\Temp\59b5b772b4ba0521930c29edbd62b7c5656526ca90556e92db7229c8a39593c8.exe"
  2⤵
  PID:944

memory/944-57-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/944-58-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/944-60-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/944-61-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/944-63-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/944-67-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/944-68-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1276-56-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/1276-66-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download