9e6b8434cc45b46f81da5534d38d1ce81046afa4ab6117488314131644f63c63

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 17:36

Target

9e6b8434cc45b46f81da5534d38d1ce81046afa4ab6117488314131644f63c63.exe
Size

21KB
MD5

7593a3b7bf5f6a7d9b56d1d8bc2c292a
SHA1

3b8bbdffdee4cff65f17095dad9a0bafd0c856f3
SHA256

9e6b8434cc45b46f81da5534d38d1ce81046afa4ab6117488314131644f63c63
SHA512

538a6973357eb14f7e80dbd3f118672245246eb254a72d5eea2756ea96f6b121fdc0a382c8b321a6bb4abca29217a914d22eb43be5a56657133bd9002f05ed26
SSDEEP

192:6ecfKsslT6BEnqp6Cx2GLhQYQ5J5ebWsLvB2:6ecCs2eBEOXhQX5nB/

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1684-55-0x0000000000400000-0x0000000000407000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
368	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1684	9e6b8434cc45b46f81da5534d38d1ce81046afa4ab6117488314131644f63c63.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 368	1684	9e6b8434cc45b46f81da5534d38d1ce81046afa4ab6117488314131644f63c63.exe	27
PID 1684 wrote to memory of 368	1684	9e6b8434cc45b46f81da5534d38d1ce81046afa4ab6117488314131644f63c63.exe	27
PID 1684 wrote to memory of 368	1684	9e6b8434cc45b46f81da5534d38d1ce81046afa4ab6117488314131644f63c63.exe	27
PID 1684 wrote to memory of 368	1684	9e6b8434cc45b46f81da5534d38d1ce81046afa4ab6117488314131644f63c63.exe	27

C:\Users\Admin\AppData\Local\Temp\9e6b8434cc45b46f81da5534d38d1ce81046afa4ab6117488314131644f63c63.exe
"C:\Users\Admin\AppData\Local\Temp\9e6b8434cc45b46f81da5534d38d1ce81046afa4ab6117488314131644f63c63.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\9E6B84~1.EXE > nul
  2⤵
  - Deletes itself
  PID:368

memory/368-54-0x0000000000000000-mapping.dmp

Download
memory/1684-55-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download