a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e

Analysis

max time kernel
162s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 08:24

Target

a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe
Size

1.3MB
MD5

6320e731dade6b75698a406f2eaf1ac0
SHA1

4b54fc9d09b44f1d72aeb1e9be7072a65a62c51f
SHA256

a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e
SHA512

759dbe8ed8abe379e5115c2988fae1b86b8c27753314c6dca82782a97c9bd36714b043ef9ba365b12d11d8f49eab058a0aacfa53ec46a8a6557bcd109d1c71f8
SSDEEP

6144:llt/9LvG6g6vdZwhvvH9cXdq0etw9R5mY0uMZVGmoJFCvngBt43wchCREaFRVser:lL/9LYgPWcX0Nw9uZarnCvnEtShMoSB

Score

8^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2012-132-0x0000000000400000-0x000000000054F000-memory.dmp	upx
behavioral2/memory/2012-134-0x0000000000400000-0x000000000054F000-memory.dmp	upx
behavioral2/memory/4084-137-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/4084-139-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/4084-140-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/2012-142-0x0000000000400000-0x000000000054F000-memory.dmp	upx
behavioral2/memory/4084-144-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2012 set thread context of 4084	2012	a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe	84

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2012	a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe
4084	a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 4084	2012	a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe	84
PID 2012 wrote to memory of 4084	2012	a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe	84
PID 2012 wrote to memory of 4084	2012	a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe	84
PID 2012 wrote to memory of 4084	2012	a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe	84
PID 2012 wrote to memory of 4084	2012	a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe	84
PID 2012 wrote to memory of 4084	2012	a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe	84
PID 2012 wrote to memory of 4084	2012	a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe	84
PID 2012 wrote to memory of 4084	2012	a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe	84

C:\Users\Admin\AppData\Local\Temp\a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe
"C:\Users\Admin\AppData\Local\Temp\a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe
  "C:\Users\Admin\AppData\Local\Temp\a7b38d586619db0335c48667eccb2518493632484c129a4d2d71709a3e2cbb1e.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4084

memory/2012-132-0x0000000000400000-0x000000000054F000-memory.dmp

Filesize
1.3MB

Download
memory/2012-134-0x0000000000400000-0x000000000054F000-memory.dmp

Filesize
1.3MB

Download
memory/2012-142-0x0000000000400000-0x000000000054F000-memory.dmp

Filesize
1.3MB

Download
memory/4084-137-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4084-139-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4084-140-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4084-144-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download