6cc0505bc3d39f9806d605ba115dd302da1f485554ec44c9c96286f5ea34d909

Analysis

max time kernel
68s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-02-2023 01:36

Target

Srenshare tool/Tools/UserAssistView.exe
Size

30KB
MD5

f36530f46a34516be38521ee9a134d28
SHA1

47f0553e0a0febbef59fd9a32149497bbdd5229c
SHA256

bc11c4150bbc6f8b2cf7bc96bedbb183c61d53ab8e4052b15d58bad6b6d1befa
SHA512

5c1a1282ffc25409d0044770c80e92f7a89fb40567dbb24f64f46750083bb30b842a63ef58b8b9433fa5a5903a5aa7bf71ee941709365c6bc17a9f4d85b1ad5d
SSDEEP

384:IecsPHRggjhCnMgZas8+oAEqPm63AovtX625wWMPODVDSt/U/BEUxhUp5Erzrbqu:HhCWSrPlX62arODxS1U/Br9nrbqUo

Score

9^/10

upx

Nirsoft 2 IoCs

Processes:

resource	yara_rule
behavioral31/memory/2040-55-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral31/memory/2040-56-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral31/memory/2040-55-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral31/memory/2040-56-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

UserAssistView.exe

pid process

2040 UserAssistView.exe

pid	process
2040	UserAssistView.exe

C:\Users\Admin\AppData\Local\Temp\Srenshare tool\Tools\UserAssistView.exe
"C:\Users\Admin\AppData\Local\Temp\Srenshare tool\Tools\UserAssistView.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2040

memory/2040-54-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/2040-55-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2040-56-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download