cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 17:22

Target

cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242.exe
Size

209KB
MD5

beea3b7deafe7aa6d05970e64d542b58
SHA1

057ab80c10afe85afe9f44db6f07e845c2af6f53
SHA256

cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242
SHA512

72623f312f0aaa05ce9d4cd85096f3a85b30edf805234bc3d1adfb545ac5c2b1a17c02e6bc19176c25ed3abfe3112dbaa1df7bcbe9046161c58af050c467898b
SSDEEP

3072:JfyJvWvUQqJot3c+3BQ4IgQsqCQPixmtxkUVIwe8qrZ3Qli17ygYDDF+AsFXzTB3:5yFZQqATMAwIwezNVYgAsFXzTx

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1488-55-0x0000000000400000-0x0000000000456000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 2044	1488	cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242.exe	26

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2044	1488	cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242.exe	26
PID 1488 wrote to memory of 2044	1488	cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242.exe	26
PID 1488 wrote to memory of 2044	1488	cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242.exe	26
PID 1488 wrote to memory of 2044	1488	cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242.exe	26
PID 1488 wrote to memory of 2044	1488	cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242.exe	26
PID 1488 wrote to memory of 2044	1488	cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242.exe	26
PID 1488 wrote to memory of 2044	1488	cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242.exe	26
PID 1488 wrote to memory of 2044	1488	cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242.exe	26
PID 1488 wrote to memory of 2044	1488	cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242.exe	26

C:\Users\Admin\AppData\Local\Temp\cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242.exe
"C:\Users\Admin\AppData\Local\Temp\cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242.exe
  C:\Users\Admin\AppData\Local\Temp\cf1a401e29017106ba3397104f7843e1204eb392ba1eda8f8a032a43c3743242.exe
  2⤵
  PID:2044

memory/1488-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1488-55-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2044-56-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2044-57-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2044-59-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2044-60-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2044-62-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2044-63-0x0000000000432055-mapping.dmp

Download
memory/2044-66-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download