27a78245986fa132a1fa85b43e253a9c1d52aa8b3dc07426e2fcfccbebc16876

Analysis

max time kernel
236s
max time network
351s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:29

Target

27a78245986fa132a1fa85b43e253a9c1d52aa8b3dc07426e2fcfccbebc16876.exe
Size

74KB
MD5

4754029140fc62a7268ec19e0068474e
SHA1

376e441f3deb459732cb32bd2ee5c17d33c611a7
SHA256

27a78245986fa132a1fa85b43e253a9c1d52aa8b3dc07426e2fcfccbebc16876
SHA512

034f484ba2c56af252e1c764477c6fc094d9f32847aac5047569ce56357762038c5758b657960a7c5b219e60a4c7ad851726fb08e6374e413699dc32b5a5aebb
SSDEEP

768:jJyjiEhotSX7NWTZFfaLWO165V5VvHZ3m11apapXl5czpKi2By1E2R4:tT0Uko/iL116VFHZLpm5cwirE2i

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/576-56-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/576-57-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/576-58-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

27a78245986fa132a1fa85b43e253a9c1d52aa8b3dc07426e2fcfccbebc16876.exe

pid process

576 27a78245986fa132a1fa85b43e253a9c1d52aa8b3dc07426e2fcfccbebc16876.exe

pid	process
576	27a78245986fa132a1fa85b43e253a9c1d52aa8b3dc07426e2fcfccbebc16876.exe

C:\Users\Admin\AppData\Local\Temp\27a78245986fa132a1fa85b43e253a9c1d52aa8b3dc07426e2fcfccbebc16876.exe
"C:\Users\Admin\AppData\Local\Temp\27a78245986fa132a1fa85b43e253a9c1d52aa8b3dc07426e2fcfccbebc16876.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:576

memory/576-54-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/576-55-0x00000000763A1000-0x00000000763A3000-memory.dmp

Filesize
8KB

Download
memory/576-56-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/576-57-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/576-58-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download