1834b39f16b648ce8224a410f8e6ad79457c156d4307ec8358f26b2c6cd52a40 | Triage

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-06-2022 18:09

Sharing

Report Analysis Logs

General

Target

1834b39f16b648ce8224a410f8e6ad79457c156d4307ec8358f26b2c6cd52a40.exe
Size

557KB
MD5

dce61f983fd41cfdae55b6c1f7dbe5e5
SHA1

e71fcbdbe993f4824e7bede10288863ef60e60bc
SHA256

1834b39f16b648ce8224a410f8e6ad79457c156d4307ec8358f26b2c6cd52a40
SHA512

165feab9e3162aef8f830e79a7d4b76f26c5c746904d1a9d86cb3d86c9133f414f8c3ab2506b0af211d958c900a72bd64f7e011ace1b9baa732c489a173caae9

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/800-55-0x0000000000400000-0x0000000000526000-memory.dmp	upx

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

1834b39f16b648ce8224a410f8e6ad79457c156d4307ec8358f26b2c6cd52a40.exe

pid process

800 1834b39f16b648ce8224a410f8e6ad79457c156d4307ec8358f26b2c6cd52a40.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

1834b39f16b648ce8224a410f8e6ad79457c156d4307ec8358f26b2c6cd52a40.exe

pid process

800 1834b39f16b648ce8224a410f8e6ad79457c156d4307ec8358f26b2c6cd52a40.exe

C:\Users\Admin\AppData\Local\Temp\1834b39f16b648ce8224a410f8e6ad79457c156d4307ec8358f26b2c6cd52a40.exe
"C:\Users\Admin\AppData\Local\Temp\1834b39f16b648ce8224a410f8e6ad79457c156d4307ec8358f26b2c6cd52a40.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-54-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/800-55-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download