47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 10:25

Target

47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe
Size

130KB
MD5

50c3bd2393d4eadbe9547648fde84afa
SHA1

0172e45032eb44a837027c32dc31661a912a4cf7
SHA256

47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb
SHA512

9c8f8a2b90025c15917454dc6264bbf3e774a301d3318bf07f54794a0dd21745e177903e2e083508e1f278688f00a11994bc1aecc026b7ae5816ef8e12cbf270
SSDEEP

3072:XTG1QgbTxHHIsBHKGXCbOqjsXb8eedXWp/e:XTG1H3tIwqGXCLX

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1988-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1988-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1988-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1988-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1988	47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1988	1048	47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe	27
PID 1048 wrote to memory of 1988	1048	47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe	27
PID 1048 wrote to memory of 1988	1048	47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe	27
PID 1048 wrote to memory of 1988	1048	47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe	27

C:\Users\Admin\AppData\Local\Temp\47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe
"C:\Users\Admin\AppData\Local\Temp\47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1988

memory/1048-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1048-56-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1988-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1988-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1988-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1988-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1988-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download