6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c

Analysis

max time kernel
223s
max time network
302s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 14:36

Target

6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe
Size

77KB
MD5

fddb1cfefadce99844c2b8e246dda8bb
SHA1

b28d68a4fd4ffffb5315d10807cd5a23b5f61b13
SHA256

6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c
SHA512

b455e83c8063100434ca8b4a436a0b72fa25bc864959def2e88dbe3377566477a4254afec96c97e0d0b0affa9cae3fb2242be1284270e44a874188a63c4810aa
SSDEEP

1536:D5qJAivKRzxqNLFRe/w/JZM2ooWKeSp6qs7:D5qLKRzxKRe/w/AmeC6qW

Score

8^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1592-58-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1592-60-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1592-62-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1592-66-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/1592-65-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1592-67-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1592-68-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1124 set thread context of 1592	1124	6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1124	6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1124	6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe
1124	6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1592	1124	6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe	28
PID 1124 wrote to memory of 1592	1124	6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe	28
PID 1124 wrote to memory of 1592	1124	6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe	28
PID 1124 wrote to memory of 1592	1124	6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe	28
PID 1124 wrote to memory of 1592	1124	6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe	28
PID 1124 wrote to memory of 1592	1124	6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe	28
PID 1124 wrote to memory of 1592	1124	6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe	28
PID 1124 wrote to memory of 1592	1124	6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe	28
PID 1124 wrote to memory of 1592	1124	6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe	28

C:\Users\Admin\AppData\Local\Temp\6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe
"C:\Users\Admin\AppData\Local\Temp\6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe
  C:\Users\Admin\AppData\Local\Temp\6758a3fb37e1134ea2519b18642ee4cc560962c92b0f9f337e19750c0446b43c.exe
  2⤵
  PID:1592

memory/1124-54-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download
memory/1124-61-0x00000000002E0000-0x00000000002E4000-memory.dmp

Filesize
16KB

Download
memory/1592-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/1592-57-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1592-58-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1592-60-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1592-62-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1592-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1592-65-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1592-67-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1592-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download