612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 09:58

Target

612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe
Size

78KB
MD5

c4f034ceda00b25824ebb89ece877fa2
SHA1

16d01b3f477a53e44b4383d18e4cb8bcee0d355c
SHA256

612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc
SHA512

f79814d75b35adc8f6d31bdce5a05fb8b62dcf314c7e2316aa94f1270cb19650b5e1d404d466198c24991279cda0b50bb174c2bf7639f3624b1aa497c44ea899
SSDEEP

1536:oWO4sN/RXpqE6jp3kGzbdBgJacPLs6OuCU9xRJXYo4H3Ahs/C:oTXpCqGHwP4wCoX3W3Ae/C

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1116-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1116-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1116-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1116-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1116-65-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1116	612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1116	1488	612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe	26
PID 1488 wrote to memory of 1116	1488	612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe	26
PID 1488 wrote to memory of 1116	1488	612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe	26
PID 1488 wrote to memory of 1116	1488	612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe	26

C:\Users\Admin\AppData\Local\Temp\612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe
"C:\Users\Admin\AppData\Local\Temp\612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1116

memory/1116-57-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1116-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1116-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1116-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1116-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1116-64-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/1116-65-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1488-55-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1488-56-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download