0b2f7b004f73b14d7eeebb705dff039c3392e23c3ab6c2a6bb525190e4625467

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:30

Target

0b2f7b004f73b14d7eeebb705dff039c3392e23c3ab6c2a6bb525190e4625467.exe
Size

138KB
MD5

6f917dc8a9737e8868517950c0aa0900
SHA1

7fa3457d5910273465a1fe81283d1daee59bfdb9
SHA256

0b2f7b004f73b14d7eeebb705dff039c3392e23c3ab6c2a6bb525190e4625467
SHA512

e6283a226534d1901f9ca8db9a46014a3d4d1586559eb7c30d6f31b2a34764ee8bc9d3da2838ddbe940cab59787d449d79e5d8d69feb000babb260d67f43b5a7
SSDEEP

3072:H4Bu68Ccv7VP/lm3+zI+W5/LA2N5lOMUBzVR+q/u:YBpqP/kJ8rMUMz

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1340-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1340-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1340-60-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1340-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1340	0b2f7b004f73b14d7eeebb705dff039c3392e23c3ab6c2a6bb525190e4625467.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1340	1652	0b2f7b004f73b14d7eeebb705dff039c3392e23c3ab6c2a6bb525190e4625467.exe	28
PID 1652 wrote to memory of 1340	1652	0b2f7b004f73b14d7eeebb705dff039c3392e23c3ab6c2a6bb525190e4625467.exe	28
PID 1652 wrote to memory of 1340	1652	0b2f7b004f73b14d7eeebb705dff039c3392e23c3ab6c2a6bb525190e4625467.exe	28
PID 1652 wrote to memory of 1340	1652	0b2f7b004f73b14d7eeebb705dff039c3392e23c3ab6c2a6bb525190e4625467.exe	28

C:\Users\Admin\AppData\Local\Temp\0b2f7b004f73b14d7eeebb705dff039c3392e23c3ab6c2a6bb525190e4625467.exe
"C:\Users\Admin\AppData\Local\Temp\0b2f7b004f73b14d7eeebb705dff039c3392e23c3ab6c2a6bb525190e4625467.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\0b2f7b004f73b14d7eeebb705dff039c3392e23c3ab6c2a6bb525190e4625467.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1340

memory/1340-56-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1340-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1340-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1340-60-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1340-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1340-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1652-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download