e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:17

Target

e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba.exe
Size

132KB
MD5

73c0dad3c6b0af88ab3c815141563792
SHA1

c05a9c91fc4e12f89f807f5bcd19ef0ff7ddfc6d
SHA256

e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba
SHA512

119fb02915496a7b19b0357ea8f1fbf01400e2d49d289acbecf99a5b050e3f97a1f2e9f1aaedac7082107f852551a1708bbd25351963d70f652586d476208a35
SSDEEP

768:BIwV+V+VcIVcVBHCXye6H7fhm6mPpOlNpvANDF5fixnAdc5o0G5saW0GgxNbPr:/V+V+VVV2cXmbfAzwiDWSBW0z

Score

8^/10

aspackv2

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
behavioral1/memory/1956-54-0x0000000000400000-0x0000000000421000-memory.dmp	aspack_v212_v242
behavioral1/memory/1956-64-0x0000000000400000-0x0000000000421000-memory.dmp	aspack_v212_v242

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 1192	1956	e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1956	e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1192	1956	e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba.exe	28
PID 1956 wrote to memory of 1192	1956	e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba.exe	28
PID 1956 wrote to memory of 1192	1956	e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba.exe	28
PID 1956 wrote to memory of 1192	1956	e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba.exe	28
PID 1956 wrote to memory of 1192	1956	e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba.exe	28
PID 1956 wrote to memory of 1192	1956	e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba.exe	28
PID 1956 wrote to memory of 1192	1956	e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba.exe	28
PID 1956 wrote to memory of 1192	1956	e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba.exe	28

C:\Users\Admin\AppData\Local\Temp\e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba.exe
"C:\Users\Admin\AppData\Local\Temp\e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba.exe
  C:\Users\Admin\AppData\Local\Temp\e19428082cb09c0af6a2a564f634a338cbe0c8b896f2053ec70d8d25294bbfba.exe
  2⤵
  PID:1192

memory/1192-57-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/1192-59-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1192-61-0x0000000000400200-0x0000000000400400-memory.dmp

Filesize
512B

Download
memory/1192-63-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1956-54-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1956-64-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download