c9bcd568f4f507e99afe1cce99a64056c1d644d87d28c365a81c102ee143deba

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 05:57

Target

c9bcd568f4f507e99afe1cce99a64056c1d644d87d28c365a81c102ee143deba.exe
Size

395KB
MD5

c88c3ba71a3429f15d838e81d0c5bafd
SHA1

1288eaa97ac68067fea883bf7de67454c0effaed
SHA256

c9bcd568f4f507e99afe1cce99a64056c1d644d87d28c365a81c102ee143deba
SHA512

f887ce38e7dde3cd813535bd8b31fc28ccb518deba9e26cf5ff1decf1ae8ad708cafcf960e0e48c5608815c413646ce285e345920fa171e93b244a5530b23888
SSDEEP

6144:8HS5p2//dnv3uSIy3ANNo85p8xPptyHWCNPGMpuHDMSH/aiWRBdw+8lhRCnZKtK:8HqsxVIkx80xBIVN/pujMSf/WTuLRdK

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1484-55-0x0000000000220000-0x00000000002A5000-memory.dmp	upx
behavioral1/memory/1484-59-0x0000000000220000-0x00000000002A5000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1516	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1484 set thread context of 1516	1484	c9bcd568f4f507e99afe1cce99a64056c1d644d87d28c365a81c102ee143deba.exe	28

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 1516	1484	c9bcd568f4f507e99afe1cce99a64056c1d644d87d28c365a81c102ee143deba.exe	28
PID 1484 wrote to memory of 1516	1484	c9bcd568f4f507e99afe1cce99a64056c1d644d87d28c365a81c102ee143deba.exe	28
PID 1484 wrote to memory of 1516	1484	c9bcd568f4f507e99afe1cce99a64056c1d644d87d28c365a81c102ee143deba.exe	28
PID 1484 wrote to memory of 1516	1484	c9bcd568f4f507e99afe1cce99a64056c1d644d87d28c365a81c102ee143deba.exe	28
PID 1484 wrote to memory of 1516	1484	c9bcd568f4f507e99afe1cce99a64056c1d644d87d28c365a81c102ee143deba.exe	28

C:\Users\Admin\AppData\Local\Temp\c9bcd568f4f507e99afe1cce99a64056c1d644d87d28c365a81c102ee143deba.exe
"C:\Users\Admin\AppData\Local\Temp\c9bcd568f4f507e99afe1cce99a64056c1d644d87d28c365a81c102ee143deba.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Deletes itself
  PID:1516

memory/1484-54-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1484-55-0x0000000000220000-0x00000000002A5000-memory.dmp

Filesize
532KB

Download
memory/1484-57-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1484-59-0x0000000000220000-0x00000000002A5000-memory.dmp

Filesize
532KB

Download
memory/1516-58-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1516-60-0x00000000742B1000-0x00000000742B3000-memory.dmp

Filesize
8KB

Download