a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 22:25

Target

a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe
Size

281KB
MD5

2b0d3806829a1cf44b579080722143f0
SHA1

ef0670193ccc1c0e66b63352b1269ab033884b3e
SHA256

a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559
SHA512

c1cf4a1c2b68efda0febc05b82781200f9de0c68aa6bb3d78e3df1dd7092b8cbea495053f173aefa047f6b9b0b7f0c2ff7790ea29430f5f6808db1c31be4de91
SSDEEP

6144:CdGCNGa4Qqzf1kXb82yJCpfxjreeD+Tyo856/SwQgN2Nin2K:CdGCgQqr1E1QspfhDKyol/Iub

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4636-132-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/4636-137-0x0000000000400000-0x000000000044C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4636 set thread context of 3988	4636	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4636	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 3988	4636	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe	81
PID 4636 wrote to memory of 3988	4636	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe	81
PID 4636 wrote to memory of 3988	4636	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe	81
PID 4636 wrote to memory of 3988	4636	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe	81
PID 4636 wrote to memory of 3988	4636	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe	81
PID 4636 wrote to memory of 3988	4636	a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe	81

C:\Users\Admin\AppData\Local\Temp\a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe
"C:\Users\Admin\AppData\Local\Temp\a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Temp\a0b8e56891835a1600ed73802f945354e0bfe878f5657d134f7baa0c4312d559.exe
  2⤵
  PID:3988

memory/3988-135-0x000000000040C000-0x0000000000436800-memory.dmp

Filesize
170KB

Download
memory/4636-132-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4636-137-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download