87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f

Analysis

max time kernel
178s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 01:37

Target

87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe
Size

321KB
MD5

56ac79b9a9a931d70a2dc4b99beb2c50
SHA1

b9a42af3f9ad59d82e459f423b43715cc4aff1ad
SHA256

87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f
SHA512

190b8cd66985a0db5e7fb4121184cc3507de5cefa51e509083dbecdb43682bc2b336f3c6a5fe3d9b25e9af9236342bfa737718185111190b70e040aab67bd747
SSDEEP

6144:gDbTdGYUgu/nYtp6NnsIXVi0JbCs6dxpeTXZW+FTTNgCFfN:g3XUDvg6HA036pCXZW6Ngcl

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2056-132-0x0000000000400000-0x0000000000480000-memory.dmp	upx
behavioral2/memory/2056-138-0x0000000000400000-0x0000000000480000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2056 set thread context of 4884	2056	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	78

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4884	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe
4884	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe
4884	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe
4884	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2056	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 4884	2056	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	78
PID 2056 wrote to memory of 4884	2056	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	78
PID 2056 wrote to memory of 4884	2056	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	78
PID 2056 wrote to memory of 4884	2056	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	78
PID 2056 wrote to memory of 4884	2056	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	78
PID 2056 wrote to memory of 4884	2056	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	78
PID 2056 wrote to memory of 4884	2056	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	78
PID 4884 wrote to memory of 1040	4884	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	54
PID 4884 wrote to memory of 1040	4884	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	54
PID 4884 wrote to memory of 1040	4884	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	54
PID 4884 wrote to memory of 1040	4884	87de6c09b9769536f0f1c303001b8a51c871209f59a9e4f32836e81b8eddda1f.exe	54

memory/1040-140-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2056-132-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2056-138-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4884-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4884-139-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4884-141-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download