f1845be8366cb6dadc448a04e30de94d2bd1a8bccfb843999727ade47a87cbe1

Analysis

max time kernel
222s
max time network
246s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2023, 19:42

Target

a31a80eb78d38fc02559f6fe85c89c70_exe32.exe
Size

104KB
MD5

a31a80eb78d38fc02559f6fe85c89c70
SHA1

ff698e6a420dc21044ad4e0c45d6d8dc6f48dd46
SHA256

f1845be8366cb6dadc448a04e30de94d2bd1a8bccfb843999727ade47a87cbe1
SHA512

7df404dabc82d3eb2b545e1e22480fa313bad1bc57e458430b0afd128278116efc3f29344afa5f5e494a376c5986b5d0eb8a18b08450f0b1d3cef4d9ac56a388
SSDEEP

1536:CIjytoKpvqph+0d9WgsSqz1Ng6/qmB9Bk6FPeaVuHyFIY0jIY2pQdMVTdvhIICgx:vEpv6BsS8hB46Zepy2Y0jWydMko

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2448-6-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral2/memory/4852-7-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/2448-11-0x0000000000400000-0x000000000042B000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4852 set thread context of 2448	4852	a31a80eb78d38fc02559f6fe85c89c70_exe32.exe	85

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2448	4852	a31a80eb78d38fc02559f6fe85c89c70_exe32.exe	85
PID 4852 wrote to memory of 2448	4852	a31a80eb78d38fc02559f6fe85c89c70_exe32.exe	85
PID 4852 wrote to memory of 2448	4852	a31a80eb78d38fc02559f6fe85c89c70_exe32.exe	85
PID 4852 wrote to memory of 2448	4852	a31a80eb78d38fc02559f6fe85c89c70_exe32.exe	85
PID 4852 wrote to memory of 2028	4852	a31a80eb78d38fc02559f6fe85c89c70_exe32.exe	86
PID 4852 wrote to memory of 2028	4852	a31a80eb78d38fc02559f6fe85c89c70_exe32.exe	86
PID 4852 wrote to memory of 2028	4852	a31a80eb78d38fc02559f6fe85c89c70_exe32.exe	86

C:\Users\Admin\AppData\Local\Temp\a31a80eb78d38fc02559f6fe85c89c70_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\a31a80eb78d38fc02559f6fe85c89c70_exe32.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\5177347.bat
  2⤵
  PID:2028

C:\Users\Admin\AppData\Local\Temp\5177347.bat

Filesize
247B

MD5
87c69931548fe14f29e6f6d18d33b2a0

SHA1
8768b6675ca3e8e4f37729e00f047ebade75c802

SHA256
bd4333c46075e051152a16670e552d16bd7996308ff02fdaffd98652d8eccf06

SHA512
1ff3d5896b791ffc3dfa8b93a5e0852e6c3106d4efb821717445979eca66ddb7cf7e2e99d503ffc04c6be27c9e1948425446ddbcdc208c4ca5d799b084607a60

Download Submit
memory/2448-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2448-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4852-1-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4852-2-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/4852-7-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download