a29a726dfd966126e1a25c0335cb69b7958ca3980faf3e7fd893dd349fa55fb9

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 08:47

Target

a29a726dfd966126e1a25c0335cb69b7958ca3980faf3e7fd893dd349fa55fb9.exe
Size

136KB
MD5

16c565d67a9f278c0f3a2bda953b3c28
SHA1

e79eacf7beb026d4df748b06bfb18cadffc39e83
SHA256

a29a726dfd966126e1a25c0335cb69b7958ca3980faf3e7fd893dd349fa55fb9
SHA512

7972a5ea0c67ccf34af452e02c7cbddcdedadfd53f5308e4f9ce01edb46774f58d8cc036f2f8e4a4b9b44ddf03bce3fd288cbbc60be4a92ddc9f3901da9a4ba7
SSDEEP

3072:uTG1QgUn+sCwurpXaWCbOqjsXb8eOI0JhOUvwrhUN9P1/GP:uTG1H0CL1qWCflDu

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1552-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1552-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1552-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1552-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1552	a29a726dfd966126e1a25c0335cb69b7958ca3980faf3e7fd893dd349fa55fb9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1552	644	a29a726dfd966126e1a25c0335cb69b7958ca3980faf3e7fd893dd349fa55fb9.exe	27
PID 644 wrote to memory of 1552	644	a29a726dfd966126e1a25c0335cb69b7958ca3980faf3e7fd893dd349fa55fb9.exe	27
PID 644 wrote to memory of 1552	644	a29a726dfd966126e1a25c0335cb69b7958ca3980faf3e7fd893dd349fa55fb9.exe	27
PID 644 wrote to memory of 1552	644	a29a726dfd966126e1a25c0335cb69b7958ca3980faf3e7fd893dd349fa55fb9.exe	27

C:\Users\Admin\AppData\Local\Temp\a29a726dfd966126e1a25c0335cb69b7958ca3980faf3e7fd893dd349fa55fb9.exe
"C:\Users\Admin\AppData\Local\Temp\a29a726dfd966126e1a25c0335cb69b7958ca3980faf3e7fd893dd349fa55fb9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Users\Admin\AppData\Local\Temp\a29a726dfd966126e1a25c0335cb69b7958ca3980faf3e7fd893dd349fa55fb9.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1552

memory/644-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/644-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1552-55-0x0000000000000000-mapping.dmp

Download
memory/1552-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1552-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1552-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1552-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1552-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download