f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:48

Target

f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe
Size

845KB
MD5

af4d17d5895eb985c2b8a5daf6ea33af
SHA1

0881328dc08f60f5885edde5250b5f2738963606
SHA256

f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963
SHA512

46f6ae5fd8e1410e0041755a271c13031bdcc8d37bb02ae9ea4333e07bf3fa22cb8176830d8d17f15665f9ed1fdca7cdb3f9e01d84d234be3e6f02c7c5dc568b
SSDEEP

12288:hNh6tT4VsAxZ3p9WWTVQcll29VBkzTNZXLGTN03dHLKbmhOpxCrf:ROSVrTVP30kN5ZrO7Cj

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1464-60-0x0000000000400000-0x00000000004E7000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1464	f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ffffffff.dll	f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1464 set thread context of 1692	1464	f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe	26

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1464	f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe
1692	f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1692	1464	f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe	26
PID 1464 wrote to memory of 1692	1464	f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe	26
PID 1464 wrote to memory of 1692	1464	f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe	26
PID 1464 wrote to memory of 1692	1464	f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe	26
PID 1464 wrote to memory of 1692	1464	f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe	26
PID 1464 wrote to memory of 1692	1464	f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe	26
PID 1464 wrote to memory of 1692	1464	f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe	26
PID 1464 wrote to memory of 1692	1464	f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe	26
PID 1464 wrote to memory of 1692	1464	f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe	26

C:\Users\Admin\AppData\Local\Temp\f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe
"C:\Users\Admin\AppData\Local\Temp\f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Local\Temp\f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe
  C:\Users\Admin\AppData\Local\Temp\f6da8e84bf70cf16499ab75f45ae157d800b35e29851ae2bea75c5f0cd366963.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1692

\Windows\SysWOW64\ffffffff.dll

Filesize
1.3MB

MD5
df1c1339308d3857986f805ed26234a0

SHA1
9577ec17c44a03f23ea874a01b530ea56409403b

SHA256
ff3244acbdbaf2a589819a4e74cf0b8e9b0b9b88605705327bd1f580ccea5bc4

SHA512
e4025bd6011b79399abc67796774e8afccc1361d3f96abf15dd3f74295105dfa51f3e9ab8f775868ce8fbc3e1caf27e3cec42ef50a99fd223978147f39048954

Download Submit
memory/1464-60-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/1692-57-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1692-63-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1692-64-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download