358ab34facde83ca0e659ec8fe664c23ef548d6ba591b433e069de9d29136406

Analysis

max time kernel
42s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:45

Target

358ab34facde83ca0e659ec8fe664c23ef548d6ba591b433e069de9d29136406.exe
Size

137KB
MD5

3d49637d2951569c3024206c3d764f23
SHA1

5f9c86c0fdf3e4ba4ca8ae4b842e8c2d35e70b49
SHA256

358ab34facde83ca0e659ec8fe664c23ef548d6ba591b433e069de9d29136406
SHA512

ac10a39cb6ec0baf28450624627228a165a75214267d9c8b6cebec42606d08233c8a7e8d761955b5dd6ced1502e2b0752e984b3e3e75f13aa66d931a37e7a334
SSDEEP

3072:uVRaDcG8KYqT1x2F9LmJirrCzvPwVUDx/n:uVEsKLTKFFmvznXDN

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1732-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1732-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1732-60-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1732-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1732-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1732	358ab34facde83ca0e659ec8fe664c23ef548d6ba591b433e069de9d29136406.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1732	1436	358ab34facde83ca0e659ec8fe664c23ef548d6ba591b433e069de9d29136406.exe	27
PID 1436 wrote to memory of 1732	1436	358ab34facde83ca0e659ec8fe664c23ef548d6ba591b433e069de9d29136406.exe	27
PID 1436 wrote to memory of 1732	1436	358ab34facde83ca0e659ec8fe664c23ef548d6ba591b433e069de9d29136406.exe	27
PID 1436 wrote to memory of 1732	1436	358ab34facde83ca0e659ec8fe664c23ef548d6ba591b433e069de9d29136406.exe	27

C:\Users\Admin\AppData\Local\Temp\358ab34facde83ca0e659ec8fe664c23ef548d6ba591b433e069de9d29136406.exe
"C:\Users\Admin\AppData\Local\Temp\358ab34facde83ca0e659ec8fe664c23ef548d6ba591b433e069de9d29136406.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Local\Temp\358ab34facde83ca0e659ec8fe664c23ef548d6ba591b433e069de9d29136406.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1732

memory/1436-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1732-56-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/1732-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1732-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1732-60-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1732-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1732-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1732-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download