9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 13:06

Target

9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe
Size

193KB
MD5

e95ed0401f1d601cca801309465da07d
SHA1

50a2f349e7967757bf0d634770fc701eb900e67f
SHA256

9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1
SHA512

f9600a39b8544a97bb783e824798daba7a4657f2e1b7cd2d53d9cf11fd701d87f53fecc52e63825ef14b155ff723360f138116805661c7b1dd4aa1619d8df153
SSDEEP

3072:f6x+lTYwKtpLSVBYy3ucW2tc+olGIIVN1ynoa9Vy31B9:fb3fWqcFUfr1h331P

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3728-137-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3728 set thread context of 2372	3728	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2372	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe
2372	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe
2372	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe
2372	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3728	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 2372	3728	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	80
PID 3728 wrote to memory of 2372	3728	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	80
PID 3728 wrote to memory of 2372	3728	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	80
PID 3728 wrote to memory of 2372	3728	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	80
PID 3728 wrote to memory of 2372	3728	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	80
PID 3728 wrote to memory of 2372	3728	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	80
PID 3728 wrote to memory of 2372	3728	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	80
PID 2372 wrote to memory of 776	2372	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	47
PID 2372 wrote to memory of 776	2372	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	47
PID 2372 wrote to memory of 776	2372	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	47
PID 2372 wrote to memory of 776	2372	9f1b9f05e9fc89c58b0e1e9823e45ab66836f6582715c2bc2fda0754003d13a1.exe	47

memory/776-140-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2372-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2372-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2372-139-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2372-141-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2372-142-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3728-137-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download