c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331

Analysis

max time kernel
96s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 17:35

Target

c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe
Size

455KB
MD5

8f72c70d456e9fa3a5d758c32de19798
SHA1

270653b997c3021ddae396fe591354c7cc0bf5d0
SHA256

c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331
SHA512

64a2d51ace445cbb8f49bbb21ab71d1633ca6c2338931495745eade8e0c2e4c25cf69752122d7182fab4b68f19cc7a55f5d746fec9526bd4709bb453176a56b8
SSDEEP

3072:/ffdqhMewFDu7gr4FJ1nCVagvOfGbEuTjlgzvV+BqW7cQOlOfCicB/e8/tOk4o/X:/fZc6AuTjtB3QZOfCic0kh/X

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/928-132-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/928-138-0x0000000000400000-0x000000000046E000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 928 set thread context of 1708	928	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1708	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe
1708	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe
1708	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe
1708	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
928	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 1708	928	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	79
PID 928 wrote to memory of 1708	928	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	79
PID 928 wrote to memory of 1708	928	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	79
PID 928 wrote to memory of 1708	928	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	79
PID 928 wrote to memory of 1708	928	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	79
PID 928 wrote to memory of 1708	928	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	79
PID 928 wrote to memory of 1708	928	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	79
PID 1708 wrote to memory of 2684	1708	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	60
PID 1708 wrote to memory of 2684	1708	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	60
PID 1708 wrote to memory of 2684	1708	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	60
PID 1708 wrote to memory of 2684	1708	c32d7582e4c25e888605c5fbbef48f2558a9ef8855dd98d4ecc70b9a562f9331.exe	60

memory/928-132-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/928-138-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1708-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1708-139-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1708-140-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1708-142-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2684-141-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download