79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:43

Target

79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe
Size

170KB
MD5

37bacce71c6e6b63bf2a530218e5eee5
SHA1

e8c09b744d0b4d4b6901baf8b8ba2c9a74629084
SHA256

79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b
SHA512

bd2a84d445d45ac3ec6a7cc912e7e00257975152589ee5f1874c9d268df80cd608e4c60aaf1c10e21ff229aee87f60198bf3d3c933bf85dec762c0564d95f89c
SSDEEP

3072:4BgxXODQ/j8Xqzb+nv/UL+MioEv3RQH35uk4ZwBpXSIcgaFFw5PbCo:cej8usULH6vhQHJoZtexp

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3912-132-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral2/memory/3912-138-0x0000000000400000-0x00000000004AD000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe

description	pid	process	target process
PID 3912 set thread context of 1780	3912	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe

pid process

3912 79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe

pid	process
3912	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe

description	pid	process	target process
PID 3912 wrote to memory of 1780	3912	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe
PID 3912 wrote to memory of 1780	3912	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe
PID 3912 wrote to memory of 1780	3912	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe
PID 3912 wrote to memory of 1780	3912	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe
PID 3912 wrote to memory of 1780	3912	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe
PID 3912 wrote to memory of 1780	3912	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe
PID 3912 wrote to memory of 1780	3912	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe
PID 3912 wrote to memory of 1780	3912	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe	79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe

C:\Users\Admin\AppData\Local\Temp\79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe
"C:\Users\Admin\AppData\Local\Temp\79e64922b8d9b22bf1b9300ffaaeef0ebdf73dbfa4838ed12a7565481c74a88b.exe"
2⤵
PID:1780

memory/1780-135-0x0000000000000000-mapping.dmp

Download
memory/1780-136-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1780-139-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3912-132-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/3912-138-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download