7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95

Analysis

max time kernel
315s
max time network
379s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 09:28

Target

7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe
Size

66KB
MD5

9e05e1eaca90f95b6583daaf2abef881
SHA1

2cdf2f3c64962459c0e2dca2814f344894d9758a
SHA256

7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95
SHA512

aa00254551f190b3042d529da8c4102acd9e13f8dc5e8a3a812150e9e6a2e820adb152dbe19e032d6ca84b12bac82fc3fcdf93591d7502d2dcc27055a20099d2
SSDEEP

1536:ouLUBbf6UTWoFvbEcVe82yXYtYLsAdA8e5RAoNpK+9KiJm28HttIKqfoSUVs/l:DL0HWoFvbDe82yXsYLsAdA8e5RAoNpK2

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2216-136-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2216-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2216-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2216-142-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2216	7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 2216	4388	7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe	82
PID 4388 wrote to memory of 2216	4388	7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe	82
PID 4388 wrote to memory of 2216	4388	7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe	82

C:\Users\Admin\AppData\Local\Temp\7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe
"C:\Users\Admin\AppData\Local\Temp\7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Users\Admin\AppData\Local\Temp\7b2e3821e0ffd8a408f904f47f56f805478339b90933f689ccba90029d4d1a95.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2216

memory/2216-136-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2216-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2216-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2216-141-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/2216-142-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4388-132-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4388-134-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4388-135-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download