a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae

Analysis

max time kernel
27s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 09:30

Target

a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe
Size

54KB
MD5

ecce45ebe75fc2fceb63b305d2b9cb1a
SHA1

ca4b39f3f1438c58558fffc573fc746e587220f9
SHA256

a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae
SHA512

42004370b8d0498d5f3f7a1cc2fb8dfa9545a38b700560dd207901fb314852bb56725dd4237f912d48dbcc9eac76ecb2a430e4936fcbc57f69f30ce7659875de
SSDEEP

768:f89EYlXfPosvYxbqHBc69VG2IbDhh2YeCZCzGAP2B07Y01z:f89zlvwPEGvDhh2YeCZCSAOB6NV

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/976-56-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/976-59-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/976-60-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/976-63-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 884 set thread context of 976	884	a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
884	a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe
976	a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 976	884	a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe	28
PID 884 wrote to memory of 976	884	a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe	28
PID 884 wrote to memory of 976	884	a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe	28
PID 884 wrote to memory of 976	884	a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe	28
PID 884 wrote to memory of 976	884	a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe	28
PID 884 wrote to memory of 976	884	a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe	28
PID 884 wrote to memory of 976	884	a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe	28
PID 884 wrote to memory of 976	884	a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe	28
PID 884 wrote to memory of 976	884	a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe	28

C:\Users\Admin\AppData\Local\Temp\a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe
"C:\Users\Admin\AppData\Local\Temp\a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884
- C:\Users\Admin\AppData\Local\Temp\a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe
  C:\Users\Admin\AppData\Local\Temp\a1700de8fabca45284dc9debf288f27e8711a2f974897c91d231727aeb444cae.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:976

memory/976-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/976-57-0x00000000004085C0-mapping.dmp

Download
memory/976-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/976-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/976-63-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download