979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470

Analysis

max time kernel
25s
max time network
56s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:16

Target

979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe
Size

313KB
MD5

101c3565c313e5082d775abd49757270
SHA1

3d2a5eead2628b3d7798b757f6a76575ef936456
SHA256

979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470
SHA512

a05a9320d2094d7f74c35477c023242d6ca0d828e749e6a296b2d75e8c1eb17b59b1f709ad992a1a498ac6b79195c28a2ae1a19c73d9d25eb8ade6e89430c3ae
SSDEEP

3072:EatdMHF8k3R+OqxcipX+HlQHQ4GrsVbb7UArQMxkJd8cQWEoI77QxSoutf:E/h624t5QMhnZoI7kooS

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1952-56-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1952-60-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
916	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1952 set thread context of 956	1952	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
956	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1952	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 956	1952	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe	28
PID 1952 wrote to memory of 956	1952	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe	28
PID 1952 wrote to memory of 956	1952	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe	28
PID 1952 wrote to memory of 956	1952	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe	28
PID 1952 wrote to memory of 956	1952	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe	28
PID 1952 wrote to memory of 956	1952	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe	28
PID 1952 wrote to memory of 956	1952	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe	28
PID 1952 wrote to memory of 956	1952	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe	28
PID 1952 wrote to memory of 956	1952	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe	28
PID 1952 wrote to memory of 956	1952	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe	28
PID 956 wrote to memory of 916	956	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe	31
PID 956 wrote to memory of 916	956	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe	31
PID 956 wrote to memory of 916	956	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe	31
PID 956 wrote to memory of 916	956	979922c53e6c3fb1a94aa726b58e046ceb2450cf06aaa05748b567c88b500470.exe	31

C:\Users\Admin\AppData\Local\Temp\uninst06cc9e5.bat

Filesize
59B

MD5
2988b921fbed03f9c93c5d538932bbe3

SHA1
4b791b3d59ae76ff091c2cf201b40f5d1b432a3f

SHA256
a1769979622d3d25829be12474ad32ccfdfcac59785dac2fc10ae49c300e4ea3

SHA512
2920c6e9851973371dc238da1ee3c63d41c7820637856ee92c67e9489c1790e3fad287d229440d124e60b978f6819d04b47c40de9034cbd9de422aaafc2b07f9

Download Submit
memory/956-57-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/956-61-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/956-62-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/956-63-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/956-65-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1952-56-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1952-60-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download