b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7

Analysis

max time kernel
210s
max time network
304s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:07

Target

b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
Size

1.4MB
MD5

ad5d0f6e9cd5d646395ff1ef7a4c32b9
SHA1

b3babfcdd3c06e87048a6f1e11544568099692f3
SHA256

b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7
SHA512

2f9034addee9609f5dc9afb10fd992d51162cc3efcfe0db6348a92c4584c1f1ba3c52c54bb30aca1cacdf3f1bae7ec107cfb97404a1619c03b5582e105cdeab9
SSDEEP

24576:wQfFzvwAEUQS4vEfG1667K79HlLG5QeXrWlMrPL/ZEDsZo/UwZUTBhuS9OPK:P5vwABQSeMc6B7Rli5QeVL/ZEoZo/f07

Score

8^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/5032-137-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral2/memory/5032-139-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral2/memory/5032-140-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral2/memory/5032-141-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral2/memory/5032-142-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral2/memory/5032-143-0x0000000000400000-0x0000000000768000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

description	pid	process	target process
PID 4920 set thread context of 5032	4920	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exeb42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

pid	process
4920	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
5032	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
5032	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
5032	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
5032	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

description	pid	process	target process
PID 4920 wrote to memory of 5032	4920	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
PID 4920 wrote to memory of 5032	4920	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
PID 4920 wrote to memory of 5032	4920	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
PID 4920 wrote to memory of 5032	4920	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
PID 4920 wrote to memory of 5032	4920	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
PID 4920 wrote to memory of 5032	4920	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
PID 4920 wrote to memory of 5032	4920	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe
PID 4920 wrote to memory of 5032	4920	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe	b42a2728fa851658ae9335a58655c404d13835a002d718caee0ad57d3a7efbc7.exe

memory/4920-134-0x0000000000903000-0x0000000000905000-memory.dmp

Filesize
8KB

Download
memory/4920-135-0x0000000000903000-0x0000000000905000-memory.dmp

Filesize
8KB

Download
memory/5032-136-0x0000000000000000-mapping.dmp

Download
memory/5032-137-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/5032-139-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/5032-140-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/5032-141-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/5032-142-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/5032-143-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download