d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 07:47

Target

d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe
Size

140KB
MD5

c8696fef89e912517396fa26adeb2c1e
SHA1

ecea0737325f112f9262b997c50c72a620ba3593
SHA256

d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354
SHA512

6c4c7ab11d4825a27a656daac755c29acc10d2f74290db0db77f90009a7e0a536d9aa873c0aa1719275f61ed3eca1f94d8a3f6eafb0ff1f5f6f218c90a035cc8
SSDEEP

3072:pUyAll+Px36fsHVDWMxqlqcIXXhQj+WDRKcgBNlwwES/Y:pUyAll+PR1DnBXWj1wcaEF

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1188-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1188-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1188-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1188-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1188	d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1188	1416	d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe	27
PID 1416 wrote to memory of 1188	1416	d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe	27
PID 1416 wrote to memory of 1188	1416	d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe	27
PID 1416 wrote to memory of 1188	1416	d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe	27

C:\Users\Admin\AppData\Local\Temp\d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe
"C:\Users\Admin\AppData\Local\Temp\d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1188

memory/1188-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1188-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1188-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1188-63-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1188-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1416-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1416-56-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download