03c35d6aca5ac538b65569e687016f55f6f6930bdaa48314ba6bea2793c2eae8

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:38

Target

03c35d6aca5ac538b65569e687016f55f6f6930bdaa48314ba6bea2793c2eae8.exe
Size

140KB
MD5

2cbcb0b3ed87c2d27b21c957635c457c
SHA1

7ac0656018a3ecb8d849f31751fcdc5eb9a52e10
SHA256

03c35d6aca5ac538b65569e687016f55f6f6930bdaa48314ba6bea2793c2eae8
SHA512

ed8d13d76163102a81815879efd1aec40130ac353f2bb848e6d3a77d7ea4e801c3f30a41ff2f0979ab9eaad7b77c6ef5492bcaa51b18e6ae8180b2adcf84f4fd
SSDEEP

3072:YUlTdq+b59HcpV9UxEsIWMxqlqcIXXhQj+WDRKcaBNlwwEu/D:YUl5Fbj8pHkOnBXWj1wc8EO

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1744-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1744-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1744-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1744-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1744	03c35d6aca5ac538b65569e687016f55f6f6930bdaa48314ba6bea2793c2eae8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1744	1488	03c35d6aca5ac538b65569e687016f55f6f6930bdaa48314ba6bea2793c2eae8.exe	28
PID 1488 wrote to memory of 1744	1488	03c35d6aca5ac538b65569e687016f55f6f6930bdaa48314ba6bea2793c2eae8.exe	28
PID 1488 wrote to memory of 1744	1488	03c35d6aca5ac538b65569e687016f55f6f6930bdaa48314ba6bea2793c2eae8.exe	28
PID 1488 wrote to memory of 1744	1488	03c35d6aca5ac538b65569e687016f55f6f6930bdaa48314ba6bea2793c2eae8.exe	28

C:\Users\Admin\AppData\Local\Temp\03c35d6aca5ac538b65569e687016f55f6f6930bdaa48314ba6bea2793c2eae8.exe
"C:\Users\Admin\AppData\Local\Temp\03c35d6aca5ac538b65569e687016f55f6f6930bdaa48314ba6bea2793c2eae8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\03c35d6aca5ac538b65569e687016f55f6f6930bdaa48314ba6bea2793c2eae8.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1744

memory/1488-54-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download
memory/1488-56-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1744-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1744-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1744-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1744-63-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1744-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download