40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:33

Target

40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe
Size

70KB
MD5

f8e363075af79dc4724b50b0532125e2
SHA1

5b64be9472eee0bace6cf746d6f4bc0863fd5b3d
SHA256

40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3
SHA512

43e5d7c97b70e5a26d3f534aaf6ab63853f8ec573271ba85c15d9fa4bca9da0ad43731da16e6d7abd397c021fa0302fdd6b7d67046dd4a27f50e02056bb0872c
SSDEEP

1536:9vVTskg+K2bbYtvmWa7tbqr/bETjSFM5PDcdns/A:TWn2bMa5bM/bETsGrys/A

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1980-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1980-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1980-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1980-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1980-65-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1980	40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1980	1992	40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe	26
PID 1992 wrote to memory of 1980	1992	40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe	26
PID 1992 wrote to memory of 1980	1992	40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe	26
PID 1992 wrote to memory of 1980	1992	40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe	26

C:\Users\Admin\AppData\Local\Temp\40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe
"C:\Users\Admin\AppData\Local\Temp\40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1980

memory/1980-57-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1980-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1980-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1980-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1980-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1980-64-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/1980-65-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1992-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1992-56-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download