0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96

Analysis

max time kernel
172s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 15:56

Target

0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96.exe
Size

318KB
MD5

0fdffa7801c327193424b4c05ef1a2d7
SHA1

e0e61098bc4d443b755122dc30eab4fca227002f
SHA256

0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96
SHA512

0fc35bfd809d99839b96a0ea33012ea9c8ae2f411a9e06e3c035fa7700621f7383e10ebf7cce0d20924a21e96486921cb52de5da4440bac5baa5ada28b569860
SSDEEP

6144:pbv+st5jy71quUtFAKJZxXAAs7I5JQfeAyXsSNhUXSsh:t+4haKJHQfwyNujq

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4328-132-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/4328-136-0x0000000000400000-0x000000000049C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4328 set thread context of 5064	4328	0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96.exe	81

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 5064	4328	0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96.exe	81
PID 4328 wrote to memory of 5064	4328	0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96.exe	81
PID 4328 wrote to memory of 5064	4328	0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96.exe	81
PID 4328 wrote to memory of 5064	4328	0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96.exe	81
PID 4328 wrote to memory of 5064	4328	0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96.exe	81
PID 4328 wrote to memory of 5064	4328	0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96.exe	81
PID 4328 wrote to memory of 5064	4328	0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96.exe	81
PID 4328 wrote to memory of 5064	4328	0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96.exe	81

C:\Users\Admin\AppData\Local\Temp\0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96.exe
"C:\Users\Admin\AppData\Local\Temp\0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Users\Admin\AppData\Local\Temp\0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96.exe
  C:\Users\Admin\AppData\Local\Temp\0e428c01d32b6e3618cec25772514e5b8ccd9edb59d4d3a3a41bc035a30aae96.exe
  2⤵
  PID:5064

memory/4328-132-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4328-136-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/5064-133-0x0000000000000000-mapping.dmp

Download
memory/5064-134-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5064-137-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download