1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90

Analysis

max time kernel
227s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:18

Target

1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe
Size

132KB
MD5

4fe9e7ea27c737f2194ab5428f66bdc9
SHA1

ec78aeb12b23c8e0740253277d4b39184834e258
SHA256

1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90
SHA512

3c0c7f14fd28e9949afa3aad762e59f32ed5969f64d182635ae506c1bf60cdbb954edb1ba123790edf6c582bf31fe0db503f32e892c22c2c559a0bdd9ee15607
SSDEEP

3072:jPB11ZWv2Z05i4305nI+W5/LA2N5lOMUOzPXWD/B:rBbMq05/SgJ8rMUl

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1292-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1292-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1292-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1292-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1292	1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 1292	520	1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe	28
PID 520 wrote to memory of 1292	520	1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe	28
PID 520 wrote to memory of 1292	520	1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe	28
PID 520 wrote to memory of 1292	520	1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe	28

C:\Users\Admin\AppData\Local\Temp\1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe
"C:\Users\Admin\AppData\Local\Temp\1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:520
- C:\Users\Admin\AppData\Local\Temp\1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1292

memory/520-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1292-56-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1292-57-0x0000000075671000-0x0000000075673000-memory.dmp

Filesize
8KB

Download
memory/1292-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1292-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1292-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1292-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1292-64-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download