1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e

Analysis

max time kernel
252s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:12

Target

1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe
Size

133KB
MD5

9c0479472ba6e732184a192ccd4f11b7
SHA1

55e9cab762a0d08150f1e7f02167b55aebb7fb6a
SHA256

1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e
SHA512

01be303a022401f2e49f6b3250cdf33d58d38b59b2481ad5af95729de677a4154074cdedfd46c1a0b9e531c4ef6cfc633b6b4bc23a9d43826a4a1ffcaace95eb
SSDEEP

3072:6V3poqXb6FCGmy01zMrAoifphYSoA0GbhbhiZqiXWW/O:sXbMaDY5A0GbviZqH

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/568-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/568-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/568-60-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/568-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
568	1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 568	1940	1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe	28
PID 1940 wrote to memory of 568	1940	1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe	28
PID 1940 wrote to memory of 568	1940	1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe	28
PID 1940 wrote to memory of 568	1940	1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe	28

C:\Users\Admin\AppData\Local\Temp\1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe
"C:\Users\Admin\AppData\Local\Temp\1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:568

memory/568-56-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/568-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/568-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/568-60-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/568-62-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/568-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1940-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download