01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7

Analysis

max time kernel
42s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 10:26

Target

01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe
Size

1.2MB
MD5

1fd89a1978a607bbfe89ad41b6d59dd3
SHA1

f0f2e68740768a8a9e676314d86df663cdacba10
SHA256

01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7
SHA512

157e1f0afe3c43c5274b0c2249ee930e0cb6eb78d9f89f4d127e572ae22e8841168ee1e5561824a85cf9ef61aa91762e247e0e661073f6ec695420468700cc6b
SSDEEP

24576:bBPpAmJ0ET0V7u4nZcPEclU9tjdrPFv/l+onGzLX5+wd9JGtkT:jAmJ0lE4nZYidFlwzLXZ7J6kT

Score

8^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1104-56-0x0000000000400000-0x000000000063F000-memory.dmp	upx
behavioral1/memory/1104-58-0x0000000000400000-0x000000000063F000-memory.dmp	upx
behavioral1/memory/1104-59-0x0000000000400000-0x000000000063F000-memory.dmp	upx
behavioral1/memory/1104-61-0x0000000000400000-0x000000000063F000-memory.dmp	upx
behavioral1/memory/1104-64-0x0000000000400000-0x000000000063F000-memory.dmp	upx
behavioral1/memory/1104-66-0x0000000000400000-0x000000000063F000-memory.dmp	upx
behavioral1/memory/1104-67-0x0000000000400000-0x000000000063F000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 1104	2032	01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe	26

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2032	01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe
2032	01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1104	2032	01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe	26
PID 2032 wrote to memory of 1104	2032	01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe	26
PID 2032 wrote to memory of 1104	2032	01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe	26
PID 2032 wrote to memory of 1104	2032	01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe	26
PID 2032 wrote to memory of 1104	2032	01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe	26
PID 2032 wrote to memory of 1104	2032	01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe	26
PID 2032 wrote to memory of 1104	2032	01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe	26
PID 2032 wrote to memory of 1104	2032	01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe	26

C:\Users\Admin\AppData\Local\Temp\01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe
"C:\Users\Admin\AppData\Local\Temp\01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe
  "C:\Users\Admin\AppData\Local\Temp\01e380c113c0d9f78529acc2dd6d006ea8c08bb360a3d575579ede4c392c1ba7.exe"
  2⤵
  PID:1104

memory/1104-55-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/1104-56-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/1104-58-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/1104-59-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/1104-61-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/1104-64-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/1104-66-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/1104-67-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download
memory/2032-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2032-62-0x0000000001EA0000-0x0000000001F92000-memory.dmp

Filesize
968KB

Download