468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9

Analysis

max time kernel
169s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:39

Target

468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe
Size

746KB
MD5

2b4a4eac064e0c21dbdad638e0fea456
SHA1

bdd76464c9523fdb2c5dab5fdfb77bdca6393458
SHA256

468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9
SHA512

b8cb59c14347b43e082a1682816d0da535dde1b95bcc08cfe5354c74353dfd242b2988444ca1a77354d77dd4bf8d1e0754251f52c22d72872b399a108f9f4553
SSDEEP

12288:3oIeC8+Fm3Wq9eCsZz0W/vUPqXofOEzMqJAVcc6MhoeSXNdodtNiR2k:452Qn9enJ9YfO+JAVfgdi3wR2k

Score

8^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/100-133-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral2/memory/100-135-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral2/memory/100-136-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral2/memory/100-137-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral2/memory/100-138-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral2/memory/100-139-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral2/memory/100-140-0x0000000000400000-0x00000000004F8000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe

description	pid	process	target process
PID 4360 set thread context of 100	4360	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe

pid	process
100	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe
100	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe
100	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe
100	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe
100	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe

description	pid	process	target process
PID 4360 wrote to memory of 100	4360	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe
PID 4360 wrote to memory of 100	4360	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe
PID 4360 wrote to memory of 100	4360	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe
PID 4360 wrote to memory of 100	4360	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe
PID 4360 wrote to memory of 100	4360	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe
PID 4360 wrote to memory of 100	4360	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe
PID 4360 wrote to memory of 100	4360	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe
PID 4360 wrote to memory of 100	4360	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe	468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe

C:\Users\Admin\AppData\Local\Temp\468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe
"C:\Users\Admin\AppData\Local\Temp\468ba8685f5c3af5feba1affd9d10a327c204bd15ad51095527fb3f9af06cca9.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:100

memory/100-132-0x0000000000000000-mapping.dmp

Download
memory/100-133-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/100-135-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/100-136-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/100-137-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/100-138-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/100-139-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/100-140-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download