31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9

Analysis

max time kernel
199s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 12:16

Target

31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe
Size

776KB
MD5

193263f1ef4790721c332ef45bf0b4ba
SHA1

51a8f29910d61d958273afa2bab990fe9fe28a10
SHA256

31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9
SHA512

4b1e2454a9552bdaf2ce3b8a37f3d82becfda1adee771ebb4981ae315937817f6e6071e2a9ba2b9ba79556301ff250ee60a6f9edbce343f7618d394b007a8ac2
SSDEEP

12288:XG34RGZbsqt/egpPeu83dUAAO5K5Ye7iQ0y/XqbrRtMPbhlLB3:264sqt2wq0jq2iQ0UXqbrRt0TLB3

Score

8^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3816-134-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral2/memory/3816-136-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral2/memory/3816-137-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral2/memory/3816-138-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral2/memory/3816-139-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral2/memory/3816-140-0x0000000000400000-0x00000000004F8000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe

description	pid	process	target process
PID 1856 set thread context of 3816	1856	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe

pid	process
3816	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe
3816	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe
3816	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe
3816	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe
3816	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe

description	pid	process	target process
PID 1856 wrote to memory of 3816	1856	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe
PID 1856 wrote to memory of 3816	1856	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe
PID 1856 wrote to memory of 3816	1856	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe
PID 1856 wrote to memory of 3816	1856	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe
PID 1856 wrote to memory of 3816	1856	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe
PID 1856 wrote to memory of 3816	1856	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe
PID 1856 wrote to memory of 3816	1856	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe
PID 1856 wrote to memory of 3816	1856	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe	31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe

C:\Users\Admin\AppData\Local\Temp\31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe
"C:\Users\Admin\AppData\Local\Temp\31d19ff9dfb12995091e27f78157b5fd29eca2dbce5c88acb70aa6c26a07eec9.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:3816

memory/3816-133-0x0000000000000000-mapping.dmp

Download
memory/3816-134-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/3816-136-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/3816-137-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/3816-138-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/3816-139-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/3816-140-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download