44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d

Analysis

max time kernel
150s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:08

Target

44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
Size

1.4MB
MD5

1d5060bb33d73839800c4d469dc01201
SHA1

a44cd4ca0058e0aebc09511931119a446557576f
SHA256

44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d
SHA512

49a0eed64874ad1ba63ba8cb9d8c623de7145ed0aec53dca4f06d60ea993e6fe66c9405b11e3c7ca76263aa143cb6513f7ff7879bcd2847703fc79fcff75092a
SSDEEP

24576:rnFmIsnO/BKs78e74A+x0lWqwSJvyo4bS5VqsV4XHiELU5/TdNFjacb9wpSYgVkO:rnsOZjwe7usdYtbxvU5/7xwpekYXfyXG

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3460-137-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral2/memory/3460-140-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral2/memory/3460-141-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral2/memory/3460-142-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral2/memory/3460-143-0x0000000000400000-0x0000000000768000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe

description	pid	process	target process
PID 792 set thread context of 3460	792	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe

description	pid	process	target process
PID 792 wrote to memory of 3460	792	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
PID 792 wrote to memory of 3460	792	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
PID 792 wrote to memory of 3460	792	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
PID 792 wrote to memory of 3460	792	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
PID 792 wrote to memory of 3460	792	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
PID 792 wrote to memory of 3460	792	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
PID 792 wrote to memory of 3460	792	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe
PID 792 wrote to memory of 3460	792	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe	44dcb0fed669dd2930c3819116bb41337168f6d89989b082b3c761267669c62d.exe

memory/792-134-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/792-135-0x0000000000855000-0x0000000000857000-memory.dmp

Filesize
8KB

Download
memory/792-139-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/3460-136-0x0000000000000000-mapping.dmp

Download
memory/3460-137-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/3460-140-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/3460-141-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/3460-142-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/3460-143-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download