343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00

Analysis

max time kernel
49s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:37

Target

343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe
Size

106KB
MD5

7879a607d005024262c2d3f45ba1b145
SHA1

93bc862325ce91e5aa1b3ae3723c95d5e01761f3
SHA256

343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00
SHA512

f12079c698b9880b589bbd2fe38ffd0fa124de06f9c983fc88ba47dbd0b1d6fba27300ef27b233bf14e215c15093663238725385db48cc97c5c58c55210d764c
SSDEEP

3072:D3l4BNvzZx9FO0wHwKtSJvm8O8gysjIsmVIrLLLKEUgUqJK0LR7MRvpS7aAU2zcs:TOBtzZx9c0G2op

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1572-58-0x0000000000080000-0x000000000009D000-memory.dmp	upx
behavioral1/memory/1572-60-0x0000000000080000-0x000000000009D000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe

description	pid	process	target process
PID 1836 set thread context of 1572	1836	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe

description pid process

Token: SeDebugPrivilege 1836 343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe

description	pid	process
Token: SeDebugPrivilege	1836	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe

description	pid	process	target process
PID 1836 wrote to memory of 1572	1836	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe
PID 1836 wrote to memory of 1572	1836	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe
PID 1836 wrote to memory of 1572	1836	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe
PID 1836 wrote to memory of 1572	1836	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe
PID 1836 wrote to memory of 1572	1836	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe
PID 1836 wrote to memory of 1572	1836	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe
PID 1836 wrote to memory of 1572	1836	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe
PID 1836 wrote to memory of 1572	1836	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe	343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe

C:\Users\Admin\AppData\Local\Temp\343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe
"C:\Users\Admin\AppData\Local\Temp\343eec497bcd64a1181a95d5d5b16d4d88a06c71de48c7454eae8a268122ae00.exe"
2⤵
PID:1572

memory/1572-57-0x0000000000080000-0x000000000009D000-memory.dmp

Filesize
116KB

Download
memory/1572-58-0x0000000000080000-0x000000000009D000-memory.dmp

Filesize
116KB

Download
memory/1572-60-0x0000000000080000-0x000000000009D000-memory.dmp

Filesize
116KB

Download
memory/1572-62-0x000000000041AFE0-mapping.dmp

Download
memory/1836-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1836-55-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/1836-56-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/1836-63-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download