e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09

Analysis

max time kernel
97s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 06:47

Target

e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe
Size

925KB
MD5

6394d37d179aa8ba03d987a0e47cf8ec
SHA1

6df78f15e55e012bf6b96360b62eb284844d2e9c
SHA256

e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09
SHA512

c3295d3553bdb8ccb074dfc4d2e97fb9c43697d3f239bdc38f34b5825d493d861eaad3a54a498bcc7b60b47772629c553542e991b367b757270f3893c2a3cb96
SSDEEP

12288:wmf8PzkvaBHmLV8P22zx+kdJ00Bvuyymhcx1UG6HyNrSjqOuPn6mc2RREYJaRm:rSkv/VCWkdJ0OpGmyNtjPn68REYsk

Score

8^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/840-133-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/840-135-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/840-136-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/840-137-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/840-138-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/840-139-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/840-140-0x0000000000400000-0x00000000004E9000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe

description	pid	process	target process
PID 4416 set thread context of 840	4416	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe

pid	process
840	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe
840	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe
840	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe
840	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe
840	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe

description	pid	process	target process
PID 4416 wrote to memory of 840	4416	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe
PID 4416 wrote to memory of 840	4416	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe
PID 4416 wrote to memory of 840	4416	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe
PID 4416 wrote to memory of 840	4416	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe
PID 4416 wrote to memory of 840	4416	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe
PID 4416 wrote to memory of 840	4416	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe
PID 4416 wrote to memory of 840	4416	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe
PID 4416 wrote to memory of 840	4416	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe	e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe

C:\Users\Admin\AppData\Local\Temp\e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe
"C:\Users\Admin\AppData\Local\Temp\e8f7ab38c391f14b3eca44dc63dfe4b49787c62fa5928ce8fb0a6731f780be09.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:840

memory/840-132-0x0000000000000000-mapping.dmp

Download
memory/840-133-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/840-135-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/840-136-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/840-137-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/840-138-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/840-139-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/840-140-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download