795b6c2924a66372ffb9c372a6e03c37034fa2ede7e72ffc5fff2db52bedb2be

Analysis

max time kernel
17s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 02:01

Target

795b6c2924a66372ffb9c372a6e03c37034fa2ede7e72ffc5fff2db52bedb2be.exe
Size

53KB
MD5

17360f004a7e1929c9d697b0c204e450
SHA1

d58ffbd9853e4673324450f63939fe2d876e019d
SHA256

795b6c2924a66372ffb9c372a6e03c37034fa2ede7e72ffc5fff2db52bedb2be
SHA512

c4d1df743efccfb0eef57d77682ddabf82c2f6f2341913af1defe151a50c7dc9d343f3372fecc7da2adb709f06d03361e4d037da13c027652702d22ee2a981df
SSDEEP

1536:PAiEnQkdJHkQiPm3F5XATVbG7O5t4FRmdIyro/FFBBVn:PHyHUc4VY+dImEBB

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1668-58-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 1828	1668	795b6c2924a66372ffb9c372a6e03c37034fa2ede7e72ffc5fff2db52bedb2be.exe	27

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1828	1668	795b6c2924a66372ffb9c372a6e03c37034fa2ede7e72ffc5fff2db52bedb2be.exe	27
PID 1668 wrote to memory of 1828	1668	795b6c2924a66372ffb9c372a6e03c37034fa2ede7e72ffc5fff2db52bedb2be.exe	27
PID 1668 wrote to memory of 1828	1668	795b6c2924a66372ffb9c372a6e03c37034fa2ede7e72ffc5fff2db52bedb2be.exe	27
PID 1668 wrote to memory of 1828	1668	795b6c2924a66372ffb9c372a6e03c37034fa2ede7e72ffc5fff2db52bedb2be.exe	27
PID 1668 wrote to memory of 1828	1668	795b6c2924a66372ffb9c372a6e03c37034fa2ede7e72ffc5fff2db52bedb2be.exe	27
PID 1668 wrote to memory of 1828	1668	795b6c2924a66372ffb9c372a6e03c37034fa2ede7e72ffc5fff2db52bedb2be.exe	27

C:\Users\Admin\AppData\Local\Temp\795b6c2924a66372ffb9c372a6e03c37034fa2ede7e72ffc5fff2db52bedb2be.exe
"C:\Users\Admin\AppData\Local\Temp\795b6c2924a66372ffb9c372a6e03c37034fa2ede7e72ffc5fff2db52bedb2be.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\795b6c2924a66372ffb9c372a6e03c37034fa2ede7e72ffc5fff2db52bedb2be.exe
  C:\Users\Admin\AppData\Local\Temp\795b6c2924a66372ffb9c372a6e03c37034fa2ede7e72ffc5fff2db52bedb2be.exe
  2⤵
  PID:1828

memory/1668-58-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1828-54-0x0000000013140000-0x0000000013178000-memory.dmp

Filesize
224KB

Download
memory/1828-56-0x0000000013140000-0x0000000013178000-memory.dmp

Filesize
224KB

Download