970a3abc0d1e1f4550d3e281a021bd0aaf2b50d9b4bb91eb6ec744b46fe30a7d

Analysis

max time kernel
248s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 08:58

Target

970a3abc0d1e1f4550d3e281a021bd0aaf2b50d9b4bb91eb6ec744b46fe30a7d.exe
Size

134KB
MD5

7954276fa56a75b64a975182ca36d7d0
SHA1

b70d0d3f5284e0356f455501fd51f0515cb0c4dd
SHA256

970a3abc0d1e1f4550d3e281a021bd0aaf2b50d9b4bb91eb6ec744b46fe30a7d
SHA512

2dc5f654c7f3ba9ebde4b50be461dbe60f66b4f282e3bdc6b6958538f29e0c2d10f72de35c52e6978f260bbee922cca0fc017e3ff4f8e04b09f23e6a3591c70b
SSDEEP

3072:2+yYLWJ4VMXE3Zhq1U3jjMxsaR90ymkNPmkVMCZz+UDf/M:2+bKV0Jt3jM9/mkNP6wPDc

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/556-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/556-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/556-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/556-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
556	970a3abc0d1e1f4550d3e281a021bd0aaf2b50d9b4bb91eb6ec744b46fe30a7d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 556	652	970a3abc0d1e1f4550d3e281a021bd0aaf2b50d9b4bb91eb6ec744b46fe30a7d.exe	28
PID 652 wrote to memory of 556	652	970a3abc0d1e1f4550d3e281a021bd0aaf2b50d9b4bb91eb6ec744b46fe30a7d.exe	28
PID 652 wrote to memory of 556	652	970a3abc0d1e1f4550d3e281a021bd0aaf2b50d9b4bb91eb6ec744b46fe30a7d.exe	28
PID 652 wrote to memory of 556	652	970a3abc0d1e1f4550d3e281a021bd0aaf2b50d9b4bb91eb6ec744b46fe30a7d.exe	28

C:\Users\Admin\AppData\Local\Temp\970a3abc0d1e1f4550d3e281a021bd0aaf2b50d9b4bb91eb6ec744b46fe30a7d.exe
"C:\Users\Admin\AppData\Local\Temp\970a3abc0d1e1f4550d3e281a021bd0aaf2b50d9b4bb91eb6ec744b46fe30a7d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Users\Admin\AppData\Local\Temp\970a3abc0d1e1f4550d3e281a021bd0aaf2b50d9b4bb91eb6ec744b46fe30a7d.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:556

memory/556-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/556-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/556-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/556-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/556-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/652-54-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download
memory/652-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download