63c17f0e2ab98d4de41dc5118f2882d62b7f877e65eb04f730d246c14ca44856

Analysis

max time kernel
43s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 09:55

Target

63c17f0e2ab98d4de41dc5118f2882d62b7f877e65eb04f730d246c14ca44856.exe
Size

130KB
MD5

aa8eccada18ce710d93fad8d278fd025
SHA1

b900a10d49123bacf50d7c584f81a5efcf502a2f
SHA256

63c17f0e2ab98d4de41dc5118f2882d62b7f877e65eb04f730d246c14ca44856
SHA512

251284e6aab5a954de06a2ab1fc0b0346cc0961873f43bbf7b5f3db2a3afb539b5a474b864f0dc43dea928d5c0c8fcae5eb382ea80ccfd9f7f8d0d2b40d4c15d
SSDEEP

3072:KTG1QgQdSEQ9xRvZvBk7u9cCbOqjsXb8eJ7dUDO/V:KTG1HQdSrLRBpx9cCY7KDU

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1708-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1708-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1708-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1708-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1708	63c17f0e2ab98d4de41dc5118f2882d62b7f877e65eb04f730d246c14ca44856.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1708	1436	63c17f0e2ab98d4de41dc5118f2882d62b7f877e65eb04f730d246c14ca44856.exe	27
PID 1436 wrote to memory of 1708	1436	63c17f0e2ab98d4de41dc5118f2882d62b7f877e65eb04f730d246c14ca44856.exe	27
PID 1436 wrote to memory of 1708	1436	63c17f0e2ab98d4de41dc5118f2882d62b7f877e65eb04f730d246c14ca44856.exe	27
PID 1436 wrote to memory of 1708	1436	63c17f0e2ab98d4de41dc5118f2882d62b7f877e65eb04f730d246c14ca44856.exe	27

C:\Users\Admin\AppData\Local\Temp\63c17f0e2ab98d4de41dc5118f2882d62b7f877e65eb04f730d246c14ca44856.exe
"C:\Users\Admin\AppData\Local\Temp\63c17f0e2ab98d4de41dc5118f2882d62b7f877e65eb04f730d246c14ca44856.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Local\Temp\63c17f0e2ab98d4de41dc5118f2882d62b7f877e65eb04f730d246c14ca44856.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1708

memory/1436-54-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/1436-56-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1708-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1708-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1708-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1708-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1708-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download