f078ff57bfb8da5ccb26d1c77bffc97b4ce67f2eae7fb22d5a544ce8a28c8aa4

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-03-2023 22:06

Target

a012ea7953293c568c474301838e653c.exe
Size

401KB
MD5

a012ea7953293c568c474301838e653c
SHA1

ffecf15fceb89c31b387e712155e582ec6ebf721
SHA256

f078ff57bfb8da5ccb26d1c77bffc97b4ce67f2eae7fb22d5a544ce8a28c8aa4
SHA512

5c8bfa8cb3e76d3a6b4ae0c7e6c5d6e863925965c45716a05d844fbc4169d3e33ab59eb507c0635ad9415b548b5e276ca78cae4d0701359c6ac01227f6734fcb
SSDEEP

6144:R0+VNlPdwzTzgnDbVeMMEI408lMRcH9QZpYcwIe9DkL3pR:qm3azXcMEI4FlMudQZsDU3pR

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2012-56-0x0000000000080000-0x000000000009D000-memory.dmp	upx
behavioral1/memory/2012-57-0x0000000000080000-0x000000000009D000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

a012ea7953293c568c474301838e653c.exe

description pid process target process

PID 1808 set thread context of 2012 1808 a012ea7953293c568c474301838e653c.exe a012ea7953293c568c474301838e653c.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

a012ea7953293c568c474301838e653c.exe

pid process

1808 a012ea7953293c568c474301838e653c.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a012ea7953293c568c474301838e653c.exe

description pid process

Token: SeDebugPrivilege 1808 a012ea7953293c568c474301838e653c.exe

description	pid	process	target process
PID 1808 set thread context of 2012	1808	a012ea7953293c568c474301838e653c.exe	a012ea7953293c568c474301838e653c.exe

pid	process
1808	a012ea7953293c568c474301838e653c.exe

description	pid	process
Token: SeDebugPrivilege	1808	a012ea7953293c568c474301838e653c.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a012ea7953293c568c474301838e653c.exe

description	pid	process	target process
PID 1808 wrote to memory of 2012	1808	a012ea7953293c568c474301838e653c.exe	a012ea7953293c568c474301838e653c.exe
PID 1808 wrote to memory of 2012	1808	a012ea7953293c568c474301838e653c.exe	a012ea7953293c568c474301838e653c.exe
PID 1808 wrote to memory of 2012	1808	a012ea7953293c568c474301838e653c.exe	a012ea7953293c568c474301838e653c.exe
PID 1808 wrote to memory of 2012	1808	a012ea7953293c568c474301838e653c.exe	a012ea7953293c568c474301838e653c.exe
PID 1808 wrote to memory of 2012	1808	a012ea7953293c568c474301838e653c.exe	a012ea7953293c568c474301838e653c.exe
PID 1808 wrote to memory of 2012	1808	a012ea7953293c568c474301838e653c.exe	a012ea7953293c568c474301838e653c.exe
PID 1808 wrote to memory of 2012	1808	a012ea7953293c568c474301838e653c.exe	a012ea7953293c568c474301838e653c.exe
PID 1808 wrote to memory of 2012	1808	a012ea7953293c568c474301838e653c.exe	a012ea7953293c568c474301838e653c.exe

C:\Users\Admin\AppData\Local\Temp\a012ea7953293c568c474301838e653c.exe
"C:\Users\Admin\AppData\Local\Temp\a012ea7953293c568c474301838e653c.exe"
2⤵
PID:2012

memory/1808-60-0x0000000000170000-0x00000000001B0000-memory.dmp

Filesize
256KB

Download
memory/2012-55-0x0000000000080000-0x000000000009D000-memory.dmp

Filesize
116KB

Download
memory/2012-56-0x0000000000080000-0x000000000009D000-memory.dmp

Filesize
116KB

Download
memory/2012-57-0x0000000000080000-0x000000000009D000-memory.dmp

Filesize
116KB

Download
memory/2012-58-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download