279635d1e38d7de4ddd9d017243c10c5da4ba95be4afb96a8a8b6b1e44f5d735

Analysis

max time kernel
147s
max time network
177s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:59

Target

279635d1e38d7de4ddd9d017243c10c5da4ba95be4afb96a8a8b6b1e44f5d735.exe
Size

12KB
MD5

1c5c05eb9d52ddce3b08f99c45e541d1
SHA1

bb314dbe5568aa1227091ba709bf796dc3da16c8
SHA256

279635d1e38d7de4ddd9d017243c10c5da4ba95be4afb96a8a8b6b1e44f5d735
SHA512

e75079fd84ce6f68ee9853c5a532458c09167e0e09450f219efde445c0d2e1f63ad2d389262d6fecbece67b8f83e9f80d12f1c951d2e0876ba56a666aaeeb222
SSDEEP

192:EtvzctIHPWBCcms2kmYgBIlUktua1ptZxkMpPAp2aW5MOeGJ8wIBd:+QtIHOuxk46/tuaXTh3BeGJ8wM

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/268-56-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	268	279635d1e38d7de4ddd9d017243c10c5da4ba95be4afb96a8a8b6b1e44f5d735.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 268 wrote to memory of 1076	268	279635d1e38d7de4ddd9d017243c10c5da4ba95be4afb96a8a8b6b1e44f5d735.exe	28
PID 268 wrote to memory of 1076	268	279635d1e38d7de4ddd9d017243c10c5da4ba95be4afb96a8a8b6b1e44f5d735.exe	28
PID 268 wrote to memory of 1076	268	279635d1e38d7de4ddd9d017243c10c5da4ba95be4afb96a8a8b6b1e44f5d735.exe	28
PID 268 wrote to memory of 1076	268	279635d1e38d7de4ddd9d017243c10c5da4ba95be4afb96a8a8b6b1e44f5d735.exe	28
PID 1076 wrote to memory of 1504	1076	net.exe	30
PID 1076 wrote to memory of 1504	1076	net.exe	30
PID 1076 wrote to memory of 1504	1076	net.exe	30
PID 1076 wrote to memory of 1504	1076	net.exe	30

memory/268-56-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download