afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961

Analysis

max time kernel
165s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 08:31

Target

afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961.exe
Size

54KB
MD5

1f5fac461fc318046db20b58ca5e61e3
SHA1

7289db0a9bb444d4ab7d897cbf5db38607bfbdc3
SHA256

afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961
SHA512

2bfa93a30f583fced722d9e55f5c17f496f70cd4ad26046c23e24dcdb6f4108415b2851ea46fc8fc2523d8ac7fc6cac7c6eebe1b146810ab1480bc3d980cac1f
SSDEEP

1536:K1LpOfXWViLkuemUh+TyXTGh4UToqxzAKm8e9QIqMi7QsnxsT:K1LpOf4iLvm2y6h1E4k8GuMyrsT

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4044-137-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4044 set thread context of 3176	4044	afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4044	afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3176	4044	afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961.exe	80
PID 4044 wrote to memory of 3176	4044	afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961.exe	80
PID 4044 wrote to memory of 3176	4044	afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961.exe	80
PID 4044 wrote to memory of 3176	4044	afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961.exe	80
PID 4044 wrote to memory of 3176	4044	afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961.exe	80
PID 4044 wrote to memory of 3176	4044	afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961.exe	80
PID 4044 wrote to memory of 3176	4044	afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961.exe	80

C:\Users\Admin\AppData\Local\Temp\afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961.exe
"C:\Users\Admin\AppData\Local\Temp\afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Users\Admin\AppData\Local\Temp\afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961.exe
  "C:\Users\Admin\AppData\Local\Temp\afbe78d0b775a58c282965e5abe29c4c948b6c60239fb1ea07393653e9011961.exe"
  2⤵
  PID:3176

memory/3176-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3176-138-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3176-139-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4044-137-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download