e0a6d44a97134693b3a884319a8f2cd53b839fc469539d91e44f255c5d0fa78c | Triage

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-06-2023 18:10

Sharing

Report Analysis Logs

General

Target

WMSBar(20160120).exe
Size

421KB
MD5

2d0613cd890a74b2de87c6b4bde82b4c
SHA1

4257b205af2eb0f6332a8967763d01ff80144342
SHA256

e0a6d44a97134693b3a884319a8f2cd53b839fc469539d91e44f255c5d0fa78c
SHA512

2bbb1dde51c6199f50aa6b9daaedb60d27cad2d38b3a846428ac744d9115299ce697c60a31f03e2c84fb07c6840631b14e397371782e6b88bc9b2c6e4e53bfa9
SSDEEP

12288:TKPU7EIFQELHLpnzYPbor+RvYbAiE8yp3LG+0:TCIaE7LpGborcUoVb0

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2016-56-0x0000000000400000-0x0000000000693000-memory.dmp	upx
behavioral1/memory/2016-57-0x0000000000400000-0x0000000000693000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2016	WMSBar(20160120).exe

C:\Users\Admin\AppData\Local\Temp\WMSBar(20160120).exe
"C:\Users\Admin\AppData\Local\Temp\WMSBar(20160120).exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-56-0x0000000000400000-0x0000000000693000-memory.dmp

Filesize
2.6MB

Download
memory/2016-57-0x0000000000400000-0x0000000000693000-memory.dmp

Filesize
2.6MB

Download