a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488

Analysis

max time kernel
148s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 10:15

Target

a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe
Size

473KB
MD5

28b3a62faf42130d80c5c74f8ac234f7
SHA1

7e3ab106e89ed3e94b9a877bc4792a620be846cf
SHA256

a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488
SHA512

88a79d2744db784c5247c921a8cbe36f4300d79f561074ab4b86bf3bcb633f341deef53729314de263d3999a19a5ee4df475cfc6999a175b7fde4628a972cf16
SSDEEP

3072:KOq7sovg+1AiE5BPl03VzZzX7xKS0Quf+kFY2/lCUX8YfeCCdRgZfYEYfeCCd715:zoYWZz/kVeCCsZwteCCZx3xsZw9REX2

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/648-134-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/648-140-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 648 set thread context of 1624	648	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe	83

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1624	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe
1624	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe
1624	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe
1624	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
648	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 1624	648	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe	83
PID 648 wrote to memory of 1624	648	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe	83
PID 648 wrote to memory of 1624	648	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe	83
PID 648 wrote to memory of 1624	648	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe	83
PID 648 wrote to memory of 1624	648	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe	83
PID 648 wrote to memory of 1624	648	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe	83
PID 648 wrote to memory of 1624	648	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe	83
PID 648 wrote to memory of 1624	648	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe	83
PID 648 wrote to memory of 1624	648	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe	83
PID 1624 wrote to memory of 372	1624	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe	38
PID 1624 wrote to memory of 372	1624	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe	38
PID 1624 wrote to memory of 372	1624	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe	38
PID 1624 wrote to memory of 372	1624	a77b59fa74790db4958579d896569bd4f4ef4bdc0a6a3a4dc4e15f5198357488.exe	38

memory/372-143-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/648-134-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/648-140-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1624-136-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1624-138-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1624-139-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1624-141-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1624-142-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1624-144-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1624-145-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download