613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1

Analysis

max time kernel
144s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 12:36

Target

613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe
Size

925KB
MD5

c236d1c1740ace903c63248eebc27eb0
SHA1

6574a6bb7c26fd02e7996f8948eb32746a68fdd0
SHA256

613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1
SHA512

99d2a5d2b5911bf388ee2eef35ced32407d1c3f1c8aaa34f33e300349a7aefa7969cf0da3dce4af94a381f659d5781540761c2c8f28c51305b34ba7ec9bf3e74
SSDEEP

12288:wmf8PzkvaBHmLV8P22zx+kdJ00Bvuyymhcx1UG6HyNrSjqOuPn6mc2RREYJaRY:rSkv/VCWkdJ0OpGmyNtjPn68REYs6

Score

8^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1840-134-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/1840-136-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/1840-137-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/1840-138-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/1840-139-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/1840-140-0x0000000000400000-0x00000000004E9000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe

description	pid	process	target process
PID 952 set thread context of 1840	952	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe

pid	process
1840	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe
1840	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe
1840	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe
1840	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe
1840	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe

description	pid	process	target process
PID 952 wrote to memory of 1840	952	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe
PID 952 wrote to memory of 1840	952	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe
PID 952 wrote to memory of 1840	952	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe
PID 952 wrote to memory of 1840	952	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe
PID 952 wrote to memory of 1840	952	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe
PID 952 wrote to memory of 1840	952	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe
PID 952 wrote to memory of 1840	952	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe
PID 952 wrote to memory of 1840	952	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe	613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe

C:\Users\Admin\AppData\Local\Temp\613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe
"C:\Users\Admin\AppData\Local\Temp\613615abc19dec1cf3c21d4d61c415094aeac4b4e3c97ae5de7028b9a84be9c1.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1840

memory/1840-133-0x0000000000000000-mapping.dmp

Download
memory/1840-134-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1840-136-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1840-137-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1840-138-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1840-139-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1840-140-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download