861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71

Analysis

max time kernel
252s
max time network
327s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 21:53

Target

861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe
Size

790KB
MD5

08e981950cad690ad5e23f65aeb019f2
SHA1

4413b98202af844d668df27ce9865de3dd997517
SHA256

861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71
SHA512

e55bc747d220bc580145d2c1e9bf9e3f10bad2d5e76fa27d2af83411c94b60e008c8f12f8e24596f87e22f2ef8a28d033d03ff140ecef1df995eca53e73b6c11
SSDEEP

3072:F5EGr/+GE3uZWPFC7AMByKgweHhvvmBe:F+LuZWPFC7AMCh

Score

8^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4240-134-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/1400-136-0x00000000008D0000-0x000000000090B000-memory.dmp	upx
behavioral2/memory/4240-137-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/4240-138-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/4240-141-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/4240-142-0x00000000008D0000-0x000000000090B000-memory.dmp	upx
behavioral2/memory/4240-143-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 4240	1400	861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4240	861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 896	1400	861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe	81
PID 1400 wrote to memory of 896	1400	861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe	81
PID 1400 wrote to memory of 896	1400	861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe	81
PID 1400 wrote to memory of 4240	1400	861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe	82
PID 1400 wrote to memory of 4240	1400	861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe	82
PID 1400 wrote to memory of 4240	1400	861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe	82
PID 1400 wrote to memory of 4240	1400	861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe	82
PID 1400 wrote to memory of 4240	1400	861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe	82
PID 1400 wrote to memory of 4240	1400	861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe	82
PID 1400 wrote to memory of 4240	1400	861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe	82
PID 1400 wrote to memory of 4240	1400	861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe	82

C:\Users\Admin\AppData\Local\Temp\861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe
"C:\Users\Admin\AppData\Local\Temp\861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:896
- C:\Users\Admin\AppData\Local\Temp\861104ce951369cc556729f2036f0460cc398e2d7ac777289f15f99e5722dc71.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4240

memory/1400-136-0x00000000008D0000-0x000000000090B000-memory.dmp

Filesize
236KB

Download
memory/4240-134-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4240-137-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4240-138-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4240-141-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4240-142-0x00000000008D0000-0x000000000090B000-memory.dmp

Filesize
236KB

Download
memory/4240-143-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download