96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12

Analysis

max time kernel
185s
max time network
232s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 08:30

Target

96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12.exe
Size

594KB
MD5

88514df2c0e94b6faf10872ce409494d
SHA1

5bd7cd79a002d18ab392706e149d86b26e6fc8a2
SHA256

96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12
SHA512

9d2a82fc81ade0301c81f314b8107dfc6c5a3c055141bf238a46f98bd6cdbd5a7c3e1915c89c407c7516ad8e3434712b8d287b26172f3444871d617f6ff54b67
SSDEEP

3072:YTvW3bZ8F+Bgzt3RcK8IWKfCwhu5x3IqDMNTpnilPy+TJgUk5jPPOI13DRpGIzxP:YTvCkoIpGQtxF0Mjp

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3160-132-0x0000000000400000-0x0000000000497000-memory.dmp	upx
behavioral2/memory/3160-138-0x0000000000400000-0x0000000000497000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3160 set thread context of 4580	3160	96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3160	96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 4580	3160	96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12.exe	82
PID 3160 wrote to memory of 4580	3160	96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12.exe	82
PID 3160 wrote to memory of 4580	3160	96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12.exe	82
PID 3160 wrote to memory of 4580	3160	96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12.exe	82
PID 3160 wrote to memory of 4580	3160	96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12.exe	82
PID 3160 wrote to memory of 4580	3160	96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12.exe	82
PID 3160 wrote to memory of 4580	3160	96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12.exe	82

C:\Users\Admin\AppData\Local\Temp\96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12.exe
"C:\Users\Admin\AppData\Local\Temp\96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Users\Admin\AppData\Local\Temp\96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12.exe
  C:\Users\Admin\AppData\Local\Temp\96c0e3ba7fb2e602e94761748eb260b80585515afc7b03288a88575f7fab8d12.exe
  2⤵
  PID:4580

memory/3160-132-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/3160-138-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4580-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4580-139-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4580-140-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download