f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41

Analysis

max time kernel
10s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 11:50

Target

f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe
Size

155KB
MD5

8a75a7674e05b8eb0ba851beedf06ed2
SHA1

9dc8f7ddad7dbaf488049e1baa215cdcba768a2a
SHA256

f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41
SHA512

1f2601974742132ec5df3863785e7249576fd5d37e28d64329bfcbef8dd699812e982028a96fa09c0199cbe6b9d5876916e010f27470a14be8db74e7da9d1af6
SSDEEP

3072:yHUt9IeAwf0RMEIVTpfEIEdaVo8TcWky4w6Y6J69fa8ew5vG8cXJ4OSqAy2IYjY5:yAtfqixJaQUJB

Score

8^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1104-59-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1104-60-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1104-62-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1104-66-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1104-67-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1104-70-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1104-71-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1536 set thread context of 1104	1536	f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1536	f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe
1536	f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe
1104	f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1104	1536	f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe	27
PID 1536 wrote to memory of 1104	1536	f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe	27
PID 1536 wrote to memory of 1104	1536	f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe	27
PID 1536 wrote to memory of 1104	1536	f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe	27
PID 1536 wrote to memory of 1104	1536	f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe	27
PID 1536 wrote to memory of 1104	1536	f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe	27
PID 1536 wrote to memory of 1104	1536	f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe	27
PID 1536 wrote to memory of 1104	1536	f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe	27

C:\Users\Admin\AppData\Local\Temp\f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe
"C:\Users\Admin\AppData\Local\Temp\f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Users\Admin\AppData\Local\Temp\f2a0f0872c022fd109b4a0de99e5fbdc3b7b7ab57501f120a8bd3d91da3c5b41.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1104

memory/1104-58-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1104-59-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1104-60-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1104-62-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1104-66-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1104-67-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1104-70-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1104-71-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1536-54-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/1536-56-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1536-65-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download