afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4

Analysis

max time kernel
141s
max time network
166s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 06:29

Target

afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe
Size

96KB
MD5

5a41504c683abff398b15b931e8a2c10
SHA1

2a964cb3888f71a2a5765985ea3501fd6cc21c4a
SHA256

afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4
SHA512

af4bf67c5da84fc7a2f344a1e6ad5ce7d106bfdf342ae56d72f8d8bde047e40d9cf0fc6e94b2b1bb178848823c7b525bbc3fe037806022b8660c4631bf89830a
SSDEEP

1536:5uoKwW+1XCnZDSOe2Ay2Wn6JMidWiibHxC6G8u:53KwWtXe2Ao6+idHirXS

Score

8^/10

upx

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1232-58-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1232-61-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1232-62-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1232-66-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/1232-65-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1232-68-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/1232-67-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1232-69-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 1232	1756	afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1756	afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1756	afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe
1756	afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1232	1756	afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe	28
PID 1756 wrote to memory of 1232	1756	afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe	28
PID 1756 wrote to memory of 1232	1756	afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe	28
PID 1756 wrote to memory of 1232	1756	afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe	28
PID 1756 wrote to memory of 1232	1756	afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe	28
PID 1756 wrote to memory of 1232	1756	afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe	28
PID 1756 wrote to memory of 1232	1756	afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe	28
PID 1756 wrote to memory of 1232	1756	afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe	28
PID 1756 wrote to memory of 1232	1756	afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe	28

C:\Users\Admin\AppData\Local\Temp\afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe
"C:\Users\Admin\AppData\Local\Temp\afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe
  C:\Users\Admin\AppData\Local\Temp\afe318345b940eb0d28316d9e28366712a7bbf864aa9ade784172254dd0458b4.exe
  2⤵
  PID:1232

memory/1232-62-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1232-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/1232-57-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1232-58-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1232-61-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1232-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1232-65-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1232-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1232-67-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1232-69-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1756-60-0x0000000001E80000-0x0000000001F72000-memory.dmp

Filesize
968KB

Download
memory/1756-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download