cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 04:52

Target

cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b.exe
Size

183KB
MD5

76b3ccab7921d8a4f416e1fc0cf807f1
SHA1

3bcd4bbfbafb0c13a05bd67d6ed03bb31cdae845
SHA256

cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b
SHA512

c1657057a01005f793c6a3ff59ec57fbb1910449f906f51425029a5e7d32da0abefc5d6cbdb767a9737418825db61731f8bd5cd20e1c261aa38cc921ef79e66a
SSDEEP

3072:h1pJvFq/zzoutANK6YBsEVy7gFIrgJyohdiwahThJ1tgAqEmrVIXwXyEMPuEhiVY:h1pRFqnoSSK6YBuMFImyed2hTHcAqEqm

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1452-54-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1452-55-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1452-65-0x0000000000400000-0x000000000041A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1452 set thread context of 832	1452	cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b.exe	26

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 832	1452	cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b.exe	26
PID 1452 wrote to memory of 832	1452	cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b.exe	26
PID 1452 wrote to memory of 832	1452	cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b.exe	26
PID 1452 wrote to memory of 832	1452	cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b.exe	26
PID 1452 wrote to memory of 832	1452	cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b.exe	26
PID 1452 wrote to memory of 832	1452	cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b.exe	26
PID 1452 wrote to memory of 832	1452	cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b.exe	26
PID 1452 wrote to memory of 832	1452	cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b.exe	26
PID 1452 wrote to memory of 832	1452	cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b.exe	26

C:\Users\Admin\AppData\Local\Temp\cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b.exe
"C:\Users\Admin\AppData\Local\Temp\cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1452
- \??\c:\users\admin\appdata\local\temp\cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b.exe
  "c:\users\admin\appdata\local\temp\cb6617e18e1af0adf8b3bd341cdeec0dac44dd6600c8a793b09ee66a05a83f5b.exe"
  2⤵
  PID:832

memory/832-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/832-57-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/832-59-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/832-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/832-63-0x0000000000412214-mapping.dmp

Download
memory/832-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/832-66-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/832-67-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1452-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1452-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1452-65-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download