5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 12:40

Target

5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
Size

925KB
MD5

cc35033eee401e89a46c3b8c81dd5580
SHA1

7d67214a70afea22314ec2659e49a701de58e502
SHA256

5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105
SHA512

99298770d48a45a963a6ad687e1e446440112e8ae9124435a05c9051246ed1dbc877c9f716a0968d37b9a22e79ac798865af7dce3d50c022a13fdd0eb6d78050
SSDEEP

12288:Qmf8PzkvaBHmLV8P22zx+kdJ00Bvuyymhcx1UG6HyNrSjqOuPn6mc2RREYJaRF:LSkv/VCWkdJ0OpGmyNtjPn68REYsb

Score

8^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1572-133-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/1572-135-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/1572-136-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/1572-137-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/1572-138-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/1572-139-0x0000000000400000-0x00000000004E9000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe

description	pid	process	target process
PID 3116 set thread context of 1572	3116	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe

pid	process
1572	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
1572	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
1572	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
1572	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
1572	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe

description	pid	process	target process
PID 3116 wrote to memory of 1572	3116	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
PID 3116 wrote to memory of 1572	3116	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
PID 3116 wrote to memory of 1572	3116	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
PID 3116 wrote to memory of 1572	3116	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
PID 3116 wrote to memory of 1572	3116	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
PID 3116 wrote to memory of 1572	3116	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
PID 3116 wrote to memory of 1572	3116	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
PID 3116 wrote to memory of 1572	3116	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe

C:\Users\Admin\AppData\Local\Temp\5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
"C:\Users\Admin\AppData\Local\Temp\5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1572

memory/1572-132-0x0000000000000000-mapping.dmp

Download
memory/1572-133-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1572-135-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1572-136-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1572-137-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1572-138-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1572-139-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download