a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559

Analysis

max time kernel
4s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 22:25

Target

a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe
Size

281KB
MD5

2b0d3806829a1cf44b579080722143f0
SHA1

ef0670193ccc1c0e66b63352b1269ab033884b3e
SHA256

a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559
SHA512

c1cf4a1c2b68efda0febc05b82781200f9de0c68aa6bb3d78e3df1dd7092b8cbea495053f173aefa047f6b9b0b7f0c2ff7790ea29430f5f6808db1c31be4de91
SSDEEP

6144:CdGCNGa4Qqzf1kXb82yJCpfxjreeD+Tyo856/SwQgN2Nin2K:CdGCgQqr1E1QspfhDKyol/Iub

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1972-55-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/1972-58-0x0000000000400000-0x000000000044C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 960	1972	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1972	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 960	1972	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe	28
PID 1972 wrote to memory of 960	1972	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe	28
PID 1972 wrote to memory of 960	1972	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe	28
PID 1972 wrote to memory of 960	1972	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe	28
PID 1972 wrote to memory of 960	1972	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe	28
PID 1972 wrote to memory of 960	1972	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe	28

C:\Users\Admin\AppData\Local\Temp\a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe
"C:\Users\Admin\AppData\Local\Temp\a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe
  2⤵
  PID:960

memory/960-57-0x000000000040C000-0x0000000000436800-memory.dmp

Filesize
170KB

Download
memory/1972-55-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1972-58-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download