fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9

Analysis

max time kernel
15s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 10:15

Target

fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe
Size

449KB
MD5

91f8bb877996d474a1f29c49f408e05a
SHA1

b8a8b8775aac93044ee74e080d3576f98544ab22
SHA256

fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9
SHA512

22d20fee704b7df2a8bea3f3dfddb0467848bcebdce30e4d6fde17839235ba82a86d59599eb0d71c0afbc5189b2e1bc213d20efb67289ab053f1180ea696b49f
SSDEEP

3072:KOq7sovg+1AiE5BPl03VzZzX7xKS0Quf+kFY2/lCUX8YfeCCdRgZfYEYfeCCd71e:zoYWZz/kVeCCsZwteCCZx3xsZwA

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1544-132-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/1544-140-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1544 set thread context of 3928	1544	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe	75

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3928	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe
3928	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe
3928	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe
3928	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1544	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 3928	1544	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe	75
PID 1544 wrote to memory of 3928	1544	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe	75
PID 1544 wrote to memory of 3928	1544	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe	75
PID 1544 wrote to memory of 3928	1544	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe	75
PID 1544 wrote to memory of 3928	1544	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe	75
PID 1544 wrote to memory of 3928	1544	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe	75
PID 1544 wrote to memory of 3928	1544	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe	75
PID 1544 wrote to memory of 3928	1544	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe	75
PID 1544 wrote to memory of 3928	1544	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe	75
PID 3928 wrote to memory of 3004	3928	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe	35
PID 3928 wrote to memory of 3004	3928	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe	35
PID 3928 wrote to memory of 3004	3928	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe	35
PID 3928 wrote to memory of 3004	3928	fd623709e0f325dbd83b6317a2035471a89bdfe80d9afdb98dfab2d8e2948de9.exe	35

memory/1544-132-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1544-140-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3004-143-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3928-138-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3928-139-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3928-136-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3928-141-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3928-142-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3928-144-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3928-145-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download