d56afc9e5509a02794252ae904d59d7c0d5a933a9d9cd0a5d10f28633ed07bd9

Analysis

max time kernel
35s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 07:51

Target

d56afc9e5509a02794252ae904d59d7c0d5a933a9d9cd0a5d10f28633ed07bd9.exe
Size

130KB
MD5

4db5b59083f0c67348c4b08df5a58eed
SHA1

b6ac33d11cc48e6ef400e9cc9d6139fb6e1ae220
SHA256

d56afc9e5509a02794252ae904d59d7c0d5a933a9d9cd0a5d10f28633ed07bd9
SHA512

275637d76ca02dbc0d8e5d65cd68252be10e72197ecdc94e6e59cd35e9578b77dabf49f72bd2b09831203f99e0947a52924dd17ad48b2c0b6ca4192b8d9eb0a6
SSDEEP

3072:QTG1Qgt2wwR3bVW4P+pUTCbOqjsXb8eZdUDG/M:QTG1Ht2wwR3dNTCwKDJ

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1352-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1352-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1352-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1352-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1352	d56afc9e5509a02794252ae904d59d7c0d5a933a9d9cd0a5d10f28633ed07bd9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1352	1392	d56afc9e5509a02794252ae904d59d7c0d5a933a9d9cd0a5d10f28633ed07bd9.exe	27
PID 1392 wrote to memory of 1352	1392	d56afc9e5509a02794252ae904d59d7c0d5a933a9d9cd0a5d10f28633ed07bd9.exe	27
PID 1392 wrote to memory of 1352	1392	d56afc9e5509a02794252ae904d59d7c0d5a933a9d9cd0a5d10f28633ed07bd9.exe	27
PID 1392 wrote to memory of 1352	1392	d56afc9e5509a02794252ae904d59d7c0d5a933a9d9cd0a5d10f28633ed07bd9.exe	27

C:\Users\Admin\AppData\Local\Temp\d56afc9e5509a02794252ae904d59d7c0d5a933a9d9cd0a5d10f28633ed07bd9.exe
"C:\Users\Admin\AppData\Local\Temp\d56afc9e5509a02794252ae904d59d7c0d5a933a9d9cd0a5d10f28633ed07bd9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Users\Admin\AppData\Local\Temp\d56afc9e5509a02794252ae904d59d7c0d5a933a9d9cd0a5d10f28633ed07bd9.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1352

memory/1352-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1352-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1352-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1352-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1352-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1392-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1392-57-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download