7c0aa2c6189b7a801bd999aba88123fcacd775f36e849789560e1f75ecb4561b

Analysis

max time kernel
238s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 09:27

Target

7c0aa2c6189b7a801bd999aba88123fcacd775f36e849789560e1f75ecb4561b.exe
Size

60KB
MD5

0a7608eb4cdf16764a13aa2b50c3088c
SHA1

d67e738fd98b2a3d1bfb16f8fb76366a592e7504
SHA256

7c0aa2c6189b7a801bd999aba88123fcacd775f36e849789560e1f75ecb4561b
SHA512

d3f44b4dbf591080cd76d7eee0936fcbc1a6009b80b4e190c3007b585092ceb49b345d31c9c6d549257c0e74c32d0245ca349c94bf7f6bcb67a7ea81e15feb00
SSDEEP

1536:AvVTskgNcF1y4yDubyDNd0A2RUqQFrP3SzD3Kks/3:mWNM1y+0v0A2RnQhCD3M/3

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/568-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/568-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/568-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/568-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/568-65-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
568	7c0aa2c6189b7a801bd999aba88123fcacd775f36e849789560e1f75ecb4561b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 588 wrote to memory of 568	588	7c0aa2c6189b7a801bd999aba88123fcacd775f36e849789560e1f75ecb4561b.exe	28
PID 588 wrote to memory of 568	588	7c0aa2c6189b7a801bd999aba88123fcacd775f36e849789560e1f75ecb4561b.exe	28
PID 588 wrote to memory of 568	588	7c0aa2c6189b7a801bd999aba88123fcacd775f36e849789560e1f75ecb4561b.exe	28
PID 588 wrote to memory of 568	588	7c0aa2c6189b7a801bd999aba88123fcacd775f36e849789560e1f75ecb4561b.exe	28

C:\Users\Admin\AppData\Local\Temp\7c0aa2c6189b7a801bd999aba88123fcacd775f36e849789560e1f75ecb4561b.exe
"C:\Users\Admin\AppData\Local\Temp\7c0aa2c6189b7a801bd999aba88123fcacd775f36e849789560e1f75ecb4561b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:588
- C:\Users\Admin\AppData\Local\Temp\7c0aa2c6189b7a801bd999aba88123fcacd775f36e849789560e1f75ecb4561b.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:568

memory/568-54-0x0000000000000000-mapping.dmp

Download
memory/568-57-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download
memory/568-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/568-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/568-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/568-63-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/568-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/568-65-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/588-55-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/588-56-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download