e6a77ff636c5b2c91dfbccdf6c8d9a65e5566e69eb24a79c15d6eaa5a15722f5

Analysis

max time kernel
205s
max time network
222s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:47

Target

022fbf52b5cf4858bdf5bc196879150e.exe
Size

1.2MB
MD5

022fbf52b5cf4858bdf5bc196879150e
SHA1

651082c7feba14f459d1ccb51ce738de41da2ef5
SHA256

e6a77ff636c5b2c91dfbccdf6c8d9a65e5566e69eb24a79c15d6eaa5a15722f5
SHA512

c1259375b20bd90669d77308cdfa394f7cdc23031b96061b0d29339570b5f1d1980bcd31b31e44d5bf46504ada7d931a10cc1a45a68b7c5b1f0aeef33772f662
SSDEEP

24576:8r2ASCt7vJQ+RhKNJlBPlJHSzvt1Yw27VIrYT3ExKco4hkdNY5:8JvAn1H+1YLV9ExKndNC

Score

7^/10

upx

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1504-2-0x0000000000400000-0x0000000000746000-memory.dmp	upx
behavioral2/memory/1504-3-0x0000000000400000-0x0000000000746000-memory.dmp	upx
behavioral2/memory/1504-4-0x0000000000400000-0x0000000000746000-memory.dmp	upx
behavioral2/memory/1504-8-0x0000000000400000-0x0000000000746000-memory.dmp	upx
behavioral2/memory/1504-7-0x0000000000400000-0x0000000000746000-memory.dmp	upx
behavioral2/memory/1504-9-0x0000000000400000-0x0000000000746000-memory.dmp	upx
behavioral2/memory/1504-12-0x0000000000400000-0x0000000000746000-memory.dmp	upx
behavioral2/memory/1504-50-0x0000000000400000-0x0000000000746000-memory.dmp	upx
behavioral2/memory/1504-55-0x0000000000400000-0x0000000000746000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3960 set thread context of 1504	3960	022fbf52b5cf4858bdf5bc196879150e.exe	91

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 1504	3960	022fbf52b5cf4858bdf5bc196879150e.exe	91
PID 3960 wrote to memory of 1504	3960	022fbf52b5cf4858bdf5bc196879150e.exe	91
PID 3960 wrote to memory of 1504	3960	022fbf52b5cf4858bdf5bc196879150e.exe	91
PID 3960 wrote to memory of 1504	3960	022fbf52b5cf4858bdf5bc196879150e.exe	91
PID 3960 wrote to memory of 1504	3960	022fbf52b5cf4858bdf5bc196879150e.exe	91

C:\Users\Admin\AppData\Local\Temp\022fbf52b5cf4858bdf5bc196879150e.exe
"C:\Users\Admin\AppData\Local\Temp\022fbf52b5cf4858bdf5bc196879150e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Users\Admin\AppData\Local\Temp\022fbf52b5cf4858bdf5bc196879150e.exe
  C:\Users\Admin\AppData\Local\Temp\022fbf52b5cf4858bdf5bc196879150e.exe
  2⤵
  PID:1504

C:\Users\Admin\AppData\Local\Temp\natsvc.ocx

Filesize
43B

MD5
fb5eaf65217fba6a05e7befd56f4749c

SHA1
1bc6c7b55cbd710d83f15a8899645feb49f8a5d2

SHA256
f3bdb95a4b688adb602015c36032143387068ed1710bfea4ab15a71447f3ba50

SHA512
2846e97027414cc31d8d2db6802c267c772ff09d4f604a3147ab2b3372e7632ecc2d0712cfaef1ac1adb45b92e18617c01332de2ae56e7a5946f2cb9583c5da4

Download Submit
memory/1504-8-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1504-2-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1504-3-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1504-4-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1504-7-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1504-9-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1504-12-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1504-50-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1504-55-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/3960-5-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download
memory/3960-0-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download
memory/3960-1-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download