cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 10:09

Target

cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a.exe
Size

336KB
MD5

ff81633e5fb140e8a436fb7df4d78bbd
SHA1

d518ddbaf054e377a8964b31dde3336513624b31
SHA256

cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a
SHA512

165baf002f953d2824f3b067777f4a0e9176037ac4d012f2c6bf4b08ed14997ce00d442f45526ed9f0f22c85618cebf9defd5bcec900c12b376e02812221a1b9
SSDEEP

3072:I3LeWf2VK30gKRcf9ysJf3IwidTG8RukcLBU6/cHR0E/Fo:I74KkufdIBaOcPE/i

Score

8^/10

aspackv2

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
behavioral1/memory/1308-54-0x0000000000400000-0x000000000044E000-memory.dmp	aspack_v212_v242
behavioral1/memory/1308-60-0x0000000000400000-0x000000000044E000-memory.dmp	aspack_v212_v242

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1308 set thread context of 840	1308	cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1308	cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 840	1308	cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a.exe	27
PID 1308 wrote to memory of 840	1308	cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a.exe	27
PID 1308 wrote to memory of 840	1308	cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a.exe	27
PID 1308 wrote to memory of 840	1308	cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a.exe	27
PID 1308 wrote to memory of 840	1308	cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a.exe	27
PID 1308 wrote to memory of 840	1308	cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a.exe	27
PID 1308 wrote to memory of 840	1308	cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a.exe	27
PID 1308 wrote to memory of 840	1308	cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a.exe	27

C:\Users\Admin\AppData\Local\Temp\cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a.exe
"C:\Users\Admin\AppData\Local\Temp\cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a.exe
  C:\Users\Admin\AppData\Local\Temp\cddf1dd12aaa9de6a792849af4a2b93d918b30303a2c3e22d2d235c91b86643a.exe
  2⤵
  PID:840

memory/840-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/840-58-0x0000000000407A4D-mapping.dmp

Download
memory/840-61-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/840-62-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/840-63-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1308-54-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1308-60-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download