e57a9fb4d3dc0d45b1157f58061a525c0da87d8dd7dbc606a0809e2fc0e0d7e3

Analysis

max time kernel
183s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 13:20

Target

e57a9fb4d3dc0d45b1157f58061a525c0da87d8dd7dbc606a0809e2fc0e0d7e3.exe
Size

118KB
MD5

1f0d35311dce6bcd0708d876a4867d11
SHA1

80652e814e3b9275e0038cff388ed5411a2008ed
SHA256

e57a9fb4d3dc0d45b1157f58061a525c0da87d8dd7dbc606a0809e2fc0e0d7e3
SHA512

eb36bbbe35b30c511759dc4a3615f9eaf89d8121bd66e72ad2c0b73b28ff4992cd2ff02f94937693bcd313c6f63b6fedee2fe172a691465a4761889a9eafec4b
SSDEEP

3072:IicSGJGL0oRKHD+9RgNASZw5pw9dag9Vnona9Jwr:IicpG/ZgNASoe+0Vona9

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1532-134-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1532-135-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1532-137-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1532-138-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1532-139-0x0000000000400000-0x000000000043B000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5108 set thread context of 1532	5108	e57a9fb4d3dc0d45b1157f58061a525c0da87d8dd7dbc606a0809e2fc0e0d7e3.exe	83

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 1532	5108	e57a9fb4d3dc0d45b1157f58061a525c0da87d8dd7dbc606a0809e2fc0e0d7e3.exe	83
PID 5108 wrote to memory of 1532	5108	e57a9fb4d3dc0d45b1157f58061a525c0da87d8dd7dbc606a0809e2fc0e0d7e3.exe	83
PID 5108 wrote to memory of 1532	5108	e57a9fb4d3dc0d45b1157f58061a525c0da87d8dd7dbc606a0809e2fc0e0d7e3.exe	83
PID 5108 wrote to memory of 1532	5108	e57a9fb4d3dc0d45b1157f58061a525c0da87d8dd7dbc606a0809e2fc0e0d7e3.exe	83
PID 5108 wrote to memory of 1532	5108	e57a9fb4d3dc0d45b1157f58061a525c0da87d8dd7dbc606a0809e2fc0e0d7e3.exe	83

C:\Users\Admin\AppData\Local\Temp\e57a9fb4d3dc0d45b1157f58061a525c0da87d8dd7dbc606a0809e2fc0e0d7e3.exe
"C:\Users\Admin\AppData\Local\Temp\e57a9fb4d3dc0d45b1157f58061a525c0da87d8dd7dbc606a0809e2fc0e0d7e3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Users\Admin\AppData\Local\Temp\e57a9fb4d3dc0d45b1157f58061a525c0da87d8dd7dbc606a0809e2fc0e0d7e3.exe
  "C:\Users\Admin\AppData\Local\Temp\e57a9fb4d3dc0d45b1157f58061a525c0da87d8dd7dbc606a0809e2fc0e0d7e3.exe"
  2⤵
  PID:1532

memory/1532-133-0x0000000000000000-mapping.dmp

Download
memory/1532-134-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1532-135-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1532-137-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1532-138-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1532-139-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5108-132-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/5108-136-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download