e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60

Analysis

max time kernel
63s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 06:50

Target

e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
Size

925KB
MD5

78e50558d4c6ce263df890da0918fff2
SHA1

73fb0ed1d4b09ff929cc0402723dc22fdad94675
SHA256

e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60
SHA512

2fa1a433d4286e8b46dc27aea29f42822a15767121a02baa5b30afba4e11c98322525b67e1f17a437a4d1cb3a0e17e5db9941498428f639b504988ea90b05897
SSDEEP

12288:Qmf8PzkvaBHmLV8P22zx+kdJ00Bvuyymhcx1UG6HyNrSjqOuPn6mc2RREYJaRv:LSkv/VCWkdJ0OpGmyNtjPn68REYst

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3792-133-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/3792-136-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/3792-137-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/3792-138-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/3792-139-0x0000000000400000-0x00000000004E9000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe

description	pid	process	target process
PID 1960 set thread context of 3792	1960	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe

pid	process
3792	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
3792	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
3792	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
3792	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
3792	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe

description	pid	process	target process
PID 1960 wrote to memory of 3792	1960	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
PID 1960 wrote to memory of 3792	1960	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
PID 1960 wrote to memory of 3792	1960	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
PID 1960 wrote to memory of 3792	1960	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
PID 1960 wrote to memory of 3792	1960	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
PID 1960 wrote to memory of 3792	1960	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
PID 1960 wrote to memory of 3792	1960	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
PID 1960 wrote to memory of 3792	1960	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe	e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe

C:\Users\Admin\AppData\Local\Temp\e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
"C:\Users\Admin\AppData\Local\Temp\e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:3792

memory/3792-132-0x0000000000000000-mapping.dmp

Download
memory/3792-133-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/3792-136-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/3792-137-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/3792-138-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/3792-139-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download