364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:08

Target

364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
Size

1.4MB
MD5

79a3ad7f4e0101dba86741924d430982
SHA1

54e1f654acbc89063ae1d1da60eb9c6ace120a92
SHA256

364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745
SHA512

4fee7f49410af091bbb508e0130b040567868c67ae37bbdca555a0481abf8191744bb79678bdc14c4a37f9072cf0839fa408555605abd345826535880c3ece9a
SSDEEP

24576:xauGdCtDOcHCM1adVyi7BJ/rmp668nWII2WSuGOh8rm:AuzpOciDyEJip6dnhJWSuTQ

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3036-136-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral2/memory/3036-139-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral2/memory/3036-140-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral2/memory/3036-141-0x0000000000400000-0x0000000000768000-memory.dmp	upx
behavioral2/memory/3036-142-0x0000000000400000-0x0000000000768000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe

description	pid	process	target process
PID 4284 set thread context of 3036	4284	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe

description	pid	process	target process
PID 4284 wrote to memory of 3036	4284	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
PID 4284 wrote to memory of 3036	4284	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
PID 4284 wrote to memory of 3036	4284	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
PID 4284 wrote to memory of 3036	4284	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
PID 4284 wrote to memory of 3036	4284	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
PID 4284 wrote to memory of 3036	4284	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
PID 4284 wrote to memory of 3036	4284	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe
PID 4284 wrote to memory of 3036	4284	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe	364819d346a4e8279c0a1a98de302bcbf8038f988af90aaa336132e425a16745.exe

memory/3036-135-0x0000000000000000-mapping.dmp

Download
memory/3036-136-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/3036-139-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/3036-140-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/3036-141-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/3036-142-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/4284-134-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/4284-138-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download