909593cda9a9b7fbc72cfe0ec867df1884e5fb58b1090527a7f94ab9d20073d7

Analysis

max time kernel
172s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 00:35

Target

909593cda9a9b7fbc72cfe0ec867df1884e5fb58b1090527a7f94ab9d20073d7.exe
Size

202KB
MD5

5da6e1fae45193b36fa29618e028bc5e
SHA1

681cb32406a2d1c6cb474b9623e3b6d266b7a676
SHA256

909593cda9a9b7fbc72cfe0ec867df1884e5fb58b1090527a7f94ab9d20073d7
SHA512

455b15a6fa55d2dd073f677c73eaa9ee915438f5e670ea8baae42e8cf2ad1e2522bbb4956400fcee731a06ceda44fef36ea82a4b7a4fe09244fe291a4b8d5d7f
SSDEEP

3072:hq4ryNc/mfRiw/3FTYkAWc/RrhqudmfIQ+I9qRWuepirFJ:hq4rhwAcBZc/BhSfIQO4pi/

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1484-133-0x0000000013140000-0x0000000013357000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4396 set thread context of 1484	4396	909593cda9a9b7fbc72cfe0ec867df1884e5fb58b1090527a7f94ab9d20073d7.exe	82

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 1484	4396	909593cda9a9b7fbc72cfe0ec867df1884e5fb58b1090527a7f94ab9d20073d7.exe	82
PID 4396 wrote to memory of 1484	4396	909593cda9a9b7fbc72cfe0ec867df1884e5fb58b1090527a7f94ab9d20073d7.exe	82
PID 4396 wrote to memory of 1484	4396	909593cda9a9b7fbc72cfe0ec867df1884e5fb58b1090527a7f94ab9d20073d7.exe	82
PID 4396 wrote to memory of 1484	4396	909593cda9a9b7fbc72cfe0ec867df1884e5fb58b1090527a7f94ab9d20073d7.exe	82
PID 4396 wrote to memory of 1484	4396	909593cda9a9b7fbc72cfe0ec867df1884e5fb58b1090527a7f94ab9d20073d7.exe	82

C:\Users\Admin\AppData\Local\Temp\909593cda9a9b7fbc72cfe0ec867df1884e5fb58b1090527a7f94ab9d20073d7.exe
"C:\Users\Admin\AppData\Local\Temp\909593cda9a9b7fbc72cfe0ec867df1884e5fb58b1090527a7f94ab9d20073d7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Users\Admin\AppData\Local\Temp\909593cda9a9b7fbc72cfe0ec867df1884e5fb58b1090527a7f94ab9d20073d7.exe
  "C:\Users\Admin\AppData\Local\Temp\909593cda9a9b7fbc72cfe0ec867df1884e5fb58b1090527a7f94ab9d20073d7.exe"
  2⤵
  PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1484 -ip 1484
1⤵
PID:3712

memory/1484-133-0x0000000013140000-0x0000000013357000-memory.dmp

Filesize
2.1MB

Download