478bc169adc0896a5485f9285563a05a0d47957859c1a68c51bbdc00272f9fc7

Analysis

max time kernel
58s
max time network
81s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:25

Target

478bc169adc0896a5485f9285563a05a0d47957859c1a68c51bbdc00272f9fc7.exe
Size

133KB
MD5

6459ef4298fc6781508cd0639710c6a5
SHA1

1b90b22a036eca17335fd6c53c35720b917d064a
SHA256

478bc169adc0896a5485f9285563a05a0d47957859c1a68c51bbdc00272f9fc7
SHA512

339f1deef02b260a6dba769675a048285cd7c345ad7ccdcba719fb8725ab53e819c91f3868134b371dbe671cc401bce97ea4639610b4205c1aa4014bc179e25f
SSDEEP

3072:QV3po0b1m3hAmpjjifphYSoA0GbhbhiyqiUDo/P:AJ+a7DY5A0Gbviyq/DQ

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1312-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1312-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1312-60-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1312-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1312	478bc169adc0896a5485f9285563a05a0d47957859c1a68c51bbdc00272f9fc7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1312	1324	478bc169adc0896a5485f9285563a05a0d47957859c1a68c51bbdc00272f9fc7.exe	28
PID 1324 wrote to memory of 1312	1324	478bc169adc0896a5485f9285563a05a0d47957859c1a68c51bbdc00272f9fc7.exe	28
PID 1324 wrote to memory of 1312	1324	478bc169adc0896a5485f9285563a05a0d47957859c1a68c51bbdc00272f9fc7.exe	28
PID 1324 wrote to memory of 1312	1324	478bc169adc0896a5485f9285563a05a0d47957859c1a68c51bbdc00272f9fc7.exe	28

C:\Users\Admin\AppData\Local\Temp\478bc169adc0896a5485f9285563a05a0d47957859c1a68c51bbdc00272f9fc7.exe
"C:\Users\Admin\AppData\Local\Temp\478bc169adc0896a5485f9285563a05a0d47957859c1a68c51bbdc00272f9fc7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Users\Admin\AppData\Local\Temp\478bc169adc0896a5485f9285563a05a0d47957859c1a68c51bbdc00272f9fc7.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1312

memory/1312-56-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1312-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1312-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1312-60-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1312-62-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1312-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1324-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download