8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a

Analysis

max time kernel
172s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 10:09

Target

8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a.exe
Size

159KB
MD5

c8aaaffa98357ab0680e8274110c7203
SHA1

ec494f7dd42b198a995bb13153d98169ed4548f3
SHA256

8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a
SHA512

1e10dd6c565e771f1119bcef388a2f2f4533756dd8aab7612347d4170348be51f28d4732b84efad744d71f4a69e480f47e47e2c29082500ff029ae668250ed93
SSDEEP

3072:FZG/lbqFJs6B6DxIHCkJkWP+c6kaJfKbY60P7Pmv6:FWAJNB6aJJk0IhKbY6w7P26

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4748-132-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/4748-133-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/4748-134-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/4748-140-0x0000000000400000-0x0000000000462000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4748 set thread context of 1368	4748	8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a.exe	78

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4748	8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1368	4748	8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a.exe	78
PID 4748 wrote to memory of 1368	4748	8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a.exe	78
PID 4748 wrote to memory of 1368	4748	8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a.exe	78
PID 4748 wrote to memory of 1368	4748	8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a.exe	78
PID 4748 wrote to memory of 1368	4748	8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a.exe	78
PID 4748 wrote to memory of 1368	4748	8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a.exe	78
PID 4748 wrote to memory of 1368	4748	8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a.exe	78

C:\Users\Admin\AppData\Local\Temp\8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a.exe
"C:\Users\Admin\AppData\Local\Temp\8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Users\Admin\AppData\Local\Temp\8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a.exe
  "C:\Users\Admin\AppData\Local\Temp\8102721c650e90bb50cd0063b9dcdc08168afbe283cae028397d21e081dae25a.exe"
  2⤵
  PID:1368

memory/1368-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1368-141-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1368-142-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4748-132-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4748-133-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4748-134-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4748-140-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download