3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d

Analysis

max time kernel
40s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 09:48

Target

3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe
Size

255KB
MD5

a81ccfe04de602a6fa894e36d39a6b7c
SHA1

fd85a0e31f2380e369456b25bea0dd527770bf84
SHA256

3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d
SHA512

e56d072a3448d1511cf864141e9a802f387ea4724d4b2f8d900df1647e72ef154ca0c64c15c446298adc7141887aa4ce721ef4fb7a8640efb58ef2ef722d0b81
SSDEEP

6144:WnYKiLAvXHD7McozLTDsE1A2j7n5GWDEpUTFBc9OYOg1R0tv:LwvHnMTzLTDsE62PQWDEpUc9OGWtv

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1180-55-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1180-58-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1180-60-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 596 set thread context of 1180	596	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	28

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 1180	596	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	28
PID 596 wrote to memory of 1180	596	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	28
PID 596 wrote to memory of 1180	596	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	28
PID 596 wrote to memory of 1180	596	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	28
PID 596 wrote to memory of 1180	596	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	28
PID 596 wrote to memory of 1180	596	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	28
PID 596 wrote to memory of 1180	596	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	28
PID 596 wrote to memory of 1180	596	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	28

C:\Users\Admin\AppData\Local\Temp\3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe
"C:\Users\Admin\AppData\Local\Temp\3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:596
- C:\Users\Admin\AppData\Local\Temp\3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe
  C:\Users\Admin\AppData\Local\Temp\3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe
  2⤵
  PID:1180

memory/596-63-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1180-54-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1180-55-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1180-58-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1180-60-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download