27725cfb62d7b534cc05cc31cd7c31d10ca87a4ad3bbc7db38a5cc3215118340

Analysis

max time kernel
294s
max time network
355s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 16:46

Target

27725cfb62d7b534cc05cc31cd7c31d10ca87a4ad3bbc7db38a5cc3215118340.exe
Size

244KB
MD5

dabde6a7c4c876d4629d39955881047b
SHA1

4d304eb91ac8cdfbde1f450665bf4bef87866112
SHA256

27725cfb62d7b534cc05cc31cd7c31d10ca87a4ad3bbc7db38a5cc3215118340
SHA512

fc56bd5095c13b95fc72e7275912bfe75de8707ab743a6b93b85742e70fcba943ebd697f33321c3b0479032d59cb90f673ba4b8050a37bb1a547e9174f13f432
SSDEEP

6144:/fBGxiWnoo1z+s01IzrLZTIn0Y8hkuGlaSJ1IwAdRGImncLo:/mloo1z+sTNB+laIKRGI2cLo

Score

8^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5112-133-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/5112-134-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/5112-135-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/5112-137-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/5112-136-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/5112-138-0x0000000000400000-0x000000000046D000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3320 set thread context of 5112	3320	27725cfb62d7b534cc05cc31cd7c31d10ca87a4ad3bbc7db38a5cc3215118340.exe	81

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 5112	3320	27725cfb62d7b534cc05cc31cd7c31d10ca87a4ad3bbc7db38a5cc3215118340.exe	81
PID 3320 wrote to memory of 5112	3320	27725cfb62d7b534cc05cc31cd7c31d10ca87a4ad3bbc7db38a5cc3215118340.exe	81
PID 3320 wrote to memory of 5112	3320	27725cfb62d7b534cc05cc31cd7c31d10ca87a4ad3bbc7db38a5cc3215118340.exe	81
PID 3320 wrote to memory of 5112	3320	27725cfb62d7b534cc05cc31cd7c31d10ca87a4ad3bbc7db38a5cc3215118340.exe	81
PID 3320 wrote to memory of 5112	3320	27725cfb62d7b534cc05cc31cd7c31d10ca87a4ad3bbc7db38a5cc3215118340.exe	81
PID 3320 wrote to memory of 5112	3320	27725cfb62d7b534cc05cc31cd7c31d10ca87a4ad3bbc7db38a5cc3215118340.exe	81
PID 3320 wrote to memory of 5112	3320	27725cfb62d7b534cc05cc31cd7c31d10ca87a4ad3bbc7db38a5cc3215118340.exe	81

C:\Users\Admin\AppData\Local\Temp\27725cfb62d7b534cc05cc31cd7c31d10ca87a4ad3bbc7db38a5cc3215118340.exe
"C:\Users\Admin\AppData\Local\Temp\27725cfb62d7b534cc05cc31cd7c31d10ca87a4ad3bbc7db38a5cc3215118340.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Users\Admin\AppData\Local\Temp\27725cfb62d7b534cc05cc31cd7c31d10ca87a4ad3bbc7db38a5cc3215118340.exe
  "C:\Users\Admin\AppData\Local\Temp\27725cfb62d7b534cc05cc31cd7c31d10ca87a4ad3bbc7db38a5cc3215118340.exe"
  2⤵
  PID:5112

memory/5112-132-0x0000000000000000-mapping.dmp

Download
memory/5112-133-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5112-134-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5112-135-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5112-137-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5112-136-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5112-138-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download