8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 10:43

Target

8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe
Size

925KB
MD5

09f87fa9970151c271f8b0434eaaf2a8
SHA1

5e95158747832a8e6540cbf7dccbf18cab6ac2fa
SHA256

8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12
SHA512

1305b7a95cd7258ae8b7ac5df1612c1ecadf48c3fda15a14cd255acc36cb2f9d5e7d09214d42abd9d076066a3cb9388112474de41e4d6efb832270da4655c685
SSDEEP

12288:Amf8PzkvaBHmLV8P22zx+kdJ00Bvuyymhcx1UG6HyNrSjqOuPn6mc2RREYJaR:bSkv/VCWkdJ0OpGmyNtjPn68REYs

Score

8^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2708-133-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/2708-135-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/2708-136-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/2708-137-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/2708-138-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/2708-139-0x0000000000400000-0x00000000004E9000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2824 set thread context of 2708	2824	8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2708	8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe
2708	8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe
2708	8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe
2708	8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe
2708	8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2708	2824	8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe	80
PID 2824 wrote to memory of 2708	2824	8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe	80
PID 2824 wrote to memory of 2708	2824	8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe	80
PID 2824 wrote to memory of 2708	2824	8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe	80
PID 2824 wrote to memory of 2708	2824	8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe	80
PID 2824 wrote to memory of 2708	2824	8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe	80
PID 2824 wrote to memory of 2708	2824	8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe	80
PID 2824 wrote to memory of 2708	2824	8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe	80

C:\Users\Admin\AppData\Local\Temp\8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe
"C:\Users\Admin\AppData\Local\Temp\8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Users\Admin\AppData\Local\Temp\8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe
  "C:\Users\Admin\AppData\Local\Temp\8e6b3056bb8fb560aeeb58b6e65f8cbd40022eb46bdf1b7d7c676dec578a9c12.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2708

memory/2708-132-0x0000000000000000-mapping.dmp

Download
memory/2708-133-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/2708-135-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/2708-136-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/2708-137-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/2708-138-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/2708-139-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download