7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95

Analysis

max time kernel
41s
max time network
87s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 09:28

Target

7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe
Size

66KB
MD5

9e05e1eaca90f95b6583daaf2abef881
SHA1

2cdf2f3c64962459c0e2dca2814f344894d9758a
SHA256

7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95
SHA512

aa00254551f190b3042d529da8c4102acd9e13f8dc5e8a3a812150e9e6a2e820adb152dbe19e032d6ca84b12bac82fc3fcdf93591d7502d2dcc27055a20099d2
SSDEEP

1536:ouLUBbf6UTWoFvbEcVe82yXYtYLsAdA8e5RAoNpK+9KiJm28HttIKqfoSUVs/l:DL0HWoFvbDe82yXsYLsAdA8e5RAoNpK2

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1420-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1420-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1420-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1420-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1420-65-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1420	7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1420	1512	7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe	28
PID 1512 wrote to memory of 1420	1512	7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe	28
PID 1512 wrote to memory of 1420	1512	7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe	28
PID 1512 wrote to memory of 1420	1512	7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe	28

C:\Users\Admin\AppData\Local\Temp\7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe
"C:\Users\Admin\AppData\Local\Temp\7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1420

memory/1420-56-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1420-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1420-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1420-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1420-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1420-64-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/1420-65-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1512-55-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1512-57-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download