9fffca443e63eda604e95658085596687cb793a92f5e87bd72e1694de6533fac

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 08:49

Target

9fffca443e63eda604e95658085596687cb793a92f5e87bd72e1694de6533fac.exe
Size

134KB
MD5

d13e889d28ea32741b9a355015d4901e
SHA1

a33ac812dc6d69da612048eadfe0a48b4830717a
SHA256

9fffca443e63eda604e95658085596687cb793a92f5e87bd72e1694de6533fac
SHA512

c42f75cc8f890276e6f13858526f826535f86763056785106d75b3c4b0d1ba11aa5f2539a14160ac8d4f6a21feaaf3f7743993e05b2d3c0e12fdf472e786d0cb
SSDEEP

3072:U+y0MVNI4tvvMDGaR90ymkNPmkVMCZw+UDm/I:U+0VNNtvv6H9/mkNP6wYDt

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1996-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1996-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1996-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1996-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1996	9fffca443e63eda604e95658085596687cb793a92f5e87bd72e1694de6533fac.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1996	1884	9fffca443e63eda604e95658085596687cb793a92f5e87bd72e1694de6533fac.exe	27
PID 1884 wrote to memory of 1996	1884	9fffca443e63eda604e95658085596687cb793a92f5e87bd72e1694de6533fac.exe	27
PID 1884 wrote to memory of 1996	1884	9fffca443e63eda604e95658085596687cb793a92f5e87bd72e1694de6533fac.exe	27
PID 1884 wrote to memory of 1996	1884	9fffca443e63eda604e95658085596687cb793a92f5e87bd72e1694de6533fac.exe	27

C:\Users\Admin\AppData\Local\Temp\9fffca443e63eda604e95658085596687cb793a92f5e87bd72e1694de6533fac.exe
"C:\Users\Admin\AppData\Local\Temp\9fffca443e63eda604e95658085596687cb793a92f5e87bd72e1694de6533fac.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\9fffca443e63eda604e95658085596687cb793a92f5e87bd72e1694de6533fac.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1996

memory/1884-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1884-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1996-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1996-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1996-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1996-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1996-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download