87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 01:37

Target

87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe
Size

321KB
MD5

56ac79b9a9a931d70a2dc4b99beb2c50
SHA1

b9a42af3f9ad59d82e459f423b43715cc4aff1ad
SHA256

87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f
SHA512

190b8cd66985a0db5e7fb4121184cc3507de5cefa51e509083dbecdb43682bc2b336f3c6a5fe3d9b25e9af9236342bfa737718185111190b70e040aab67bd747
SSDEEP

6144:gDbTdGYUgu/nYtp6NnsIXVi0JbCs6dxpeTXZW+FTTNgCFfN:g3XUDvg6HA036pCXZW6Ngcl

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1464-59-0x0000000000400000-0x0000000000480000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1464 set thread context of 1696	1464	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	26

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1696	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe
1696	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1464	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1696	1464	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	26
PID 1464 wrote to memory of 1696	1464	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	26
PID 1464 wrote to memory of 1696	1464	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	26
PID 1464 wrote to memory of 1696	1464	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	26
PID 1464 wrote to memory of 1696	1464	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	26
PID 1464 wrote to memory of 1696	1464	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	26
PID 1464 wrote to memory of 1696	1464	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	26
PID 1464 wrote to memory of 1696	1464	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	26
PID 1696 wrote to memory of 1360	1696	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	12
PID 1696 wrote to memory of 1360	1696	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	12
PID 1696 wrote to memory of 1360	1696	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	12
PID 1696 wrote to memory of 1360	1696	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	12

memory/1360-62-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1464-59-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1696-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1696-60-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1696-61-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1696-65-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download