f665e17483ea5ef39ccb5f51a61174ef164292961297efbb0cf887233e7793f0

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 13:12

Target

f665e17483ea5ef39ccb5f51a61174ef164292961297efbb0cf887233e7793f0.exe
Size

180KB
MD5

97cc7217be21c9bf993eba876ec61581
SHA1

ca6fdfdff97545ef4821c62e76bb6625d361c6d2
SHA256

f665e17483ea5ef39ccb5f51a61174ef164292961297efbb0cf887233e7793f0
SHA512

8bbeeb0e9109dde1ff19815e4ecfbac5ed0cb8473a79726046117c1140bdddb723ce20c85e521ccb51211ac58ff4059bba6f5ae0a76aeffaae0c13a550a8bb5c
SSDEEP

3072:WykgaXa2T0pCzg4uedLN2J5RnMqqDa/MrfgjQw9Lb0imuL13rOHTbFIqj7M:WykgPNZ6dLMCqqDGMrfgjQ2brm6mFIqk

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1932-56-0x0000000013140000-0x0000000013357000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1444 set thread context of 1932	1444	f665e17483ea5ef39ccb5f51a61174ef164292961297efbb0cf887233e7793f0.exe	27

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1932	1444	f665e17483ea5ef39ccb5f51a61174ef164292961297efbb0cf887233e7793f0.exe	27
PID 1444 wrote to memory of 1932	1444	f665e17483ea5ef39ccb5f51a61174ef164292961297efbb0cf887233e7793f0.exe	27
PID 1444 wrote to memory of 1932	1444	f665e17483ea5ef39ccb5f51a61174ef164292961297efbb0cf887233e7793f0.exe	27
PID 1444 wrote to memory of 1932	1444	f665e17483ea5ef39ccb5f51a61174ef164292961297efbb0cf887233e7793f0.exe	27
PID 1444 wrote to memory of 1932	1444	f665e17483ea5ef39ccb5f51a61174ef164292961297efbb0cf887233e7793f0.exe	27
PID 1444 wrote to memory of 1932	1444	f665e17483ea5ef39ccb5f51a61174ef164292961297efbb0cf887233e7793f0.exe	27

C:\Users\Admin\AppData\Local\Temp\f665e17483ea5ef39ccb5f51a61174ef164292961297efbb0cf887233e7793f0.exe
"C:\Users\Admin\AppData\Local\Temp\f665e17483ea5ef39ccb5f51a61174ef164292961297efbb0cf887233e7793f0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\f665e17483ea5ef39ccb5f51a61174ef164292961297efbb0cf887233e7793f0.exe
  "C:\Users\Admin\AppData\Local\Temp\f665e17483ea5ef39ccb5f51a61174ef164292961297efbb0cf887233e7793f0.exe"
  2⤵
  PID:1932

memory/1932-54-0x0000000013140000-0x0000000013357000-memory.dmp

Filesize
2.1MB

Download
memory/1932-56-0x0000000013140000-0x0000000013357000-memory.dmp

Filesize
2.1MB

Download