9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1

Analysis

max time kernel
37s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 13:06

Target

9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe
Size

193KB
MD5

e95ed0401f1d601cca801309465da07d
SHA1

50a2f349e7967757bf0d634770fc701eb900e67f
SHA256

9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1
SHA512

f9600a39b8544a97bb783e824798daba7a4657f2e1b7cd2d53d9cf11fd701d87f53fecc52e63825ef14b155ff723360f138116805661c7b1dd4aa1619d8df153
SSDEEP

3072:f6x+lTYwKtpLSVBYy3ucW2tc+olGIIVN1ynoa9Vy31B9:fb3fWqcFUfr1h331P

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2004-59-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/2004-69-0x00000000001C0000-0x00000000001F2000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2004 set thread context of 1888	2004	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1888	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe
1888	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2004	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1888	2004	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	28
PID 2004 wrote to memory of 1888	2004	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	28
PID 2004 wrote to memory of 1888	2004	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	28
PID 2004 wrote to memory of 1888	2004	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	28
PID 2004 wrote to memory of 1888	2004	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	28
PID 2004 wrote to memory of 1888	2004	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	28
PID 2004 wrote to memory of 1888	2004	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	28
PID 2004 wrote to memory of 1888	2004	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	28
PID 1888 wrote to memory of 1264	1888	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	12
PID 1888 wrote to memory of 1264	1888	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	12
PID 1888 wrote to memory of 1264	1888	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	12
PID 1888 wrote to memory of 1264	1888	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	12

memory/1264-64-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1888-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1888-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1888-62-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1888-63-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1888-67-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1888-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2004-59-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2004-60-0x00000000001C0000-0x00000000001F2000-memory.dmp

Filesize
200KB

Download
memory/2004-69-0x00000000001C0000-0x00000000001F2000-memory.dmp

Filesize
200KB

Download