b07c1bcd15c87805a17c7926423ae2f31ecf1b8b3c16eeb2aedf9e5785d82114

Analysis

max time kernel
48s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 08:33

Target

b07c1bcd15c87805a17c7926423ae2f31ecf1b8b3c16eeb2aedf9e5785d82114.exe
Size

134KB
MD5

10b74292635da50daa27f2350df189a4
SHA1

2167d315c4160666db840609f1bf6b6bc0f899ef
SHA256

b07c1bcd15c87805a17c7926423ae2f31ecf1b8b3c16eeb2aedf9e5785d82114
SHA512

18789354b987549776d1481f679f510dae53835e59f58bfd0b7d2be42e8103f9fa06f92043f979f7c42f37a63e8529a04b74af8166492f0009d2b3770a911461
SSDEEP

3072:3+yFCYy6SmkoBmN3iX9DUaR90ymkNPmkVMCZ++UD0/J:3+WFCmkMmNK9/mkNP6weDW

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1952-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1952-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1952-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1952-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1952-65-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1952	b07c1bcd15c87805a17c7926423ae2f31ecf1b8b3c16eeb2aedf9e5785d82114.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1952	1256	b07c1bcd15c87805a17c7926423ae2f31ecf1b8b3c16eeb2aedf9e5785d82114.exe	26
PID 1256 wrote to memory of 1952	1256	b07c1bcd15c87805a17c7926423ae2f31ecf1b8b3c16eeb2aedf9e5785d82114.exe	26
PID 1256 wrote to memory of 1952	1256	b07c1bcd15c87805a17c7926423ae2f31ecf1b8b3c16eeb2aedf9e5785d82114.exe	26
PID 1256 wrote to memory of 1952	1256	b07c1bcd15c87805a17c7926423ae2f31ecf1b8b3c16eeb2aedf9e5785d82114.exe	26

C:\Users\Admin\AppData\Local\Temp\b07c1bcd15c87805a17c7926423ae2f31ecf1b8b3c16eeb2aedf9e5785d82114.exe
"C:\Users\Admin\AppData\Local\Temp\b07c1bcd15c87805a17c7926423ae2f31ecf1b8b3c16eeb2aedf9e5785d82114.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Users\Admin\AppData\Local\Temp\b07c1bcd15c87805a17c7926423ae2f31ecf1b8b3c16eeb2aedf9e5785d82114.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1952

memory/1256-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1256-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1952-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1952-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1952-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1952-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1952-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1952-65-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download