b652dfea81baa995f14110b9114a27f68d8b53f5bb61ec186ece3977ed61e14d

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 19:41

Target

980f14d3a22267d778dc09382aef4f60_exe32.exe
Size

242KB
MD5

980f14d3a22267d778dc09382aef4f60
SHA1

4bbfca9412bfe84124a0cb0e383780a1d3050953
SHA256

b652dfea81baa995f14110b9114a27f68d8b53f5bb61ec186ece3977ed61e14d
SHA512

2f1d26271f7c7ad9fb1f8d5a4ffbfe7704fad626eadd93f9c819301f93027cbb700026e12e21d4c7d8562b6ea1cfb9591f536bf13afd7f5bf78b680f466f32ce
SSDEEP

6144:acAyS5Ki9+Rk0uSawWS6xytvU2VXv0YJslYb9i2uoS0:9Egtu3DS6YtFxpslYI2uoS0

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2028-0-0x0000000000400000-0x0000000000669000-memory.dmp	upx
behavioral1/memory/2028-5-0x0000000000400000-0x0000000000669000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 2576	2028	980f14d3a22267d778dc09382aef4f60_exe32.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2028	980f14d3a22267d778dc09382aef4f60_exe32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2576	2028	980f14d3a22267d778dc09382aef4f60_exe32.exe	28
PID 2028 wrote to memory of 2576	2028	980f14d3a22267d778dc09382aef4f60_exe32.exe	28
PID 2028 wrote to memory of 2576	2028	980f14d3a22267d778dc09382aef4f60_exe32.exe	28
PID 2028 wrote to memory of 2576	2028	980f14d3a22267d778dc09382aef4f60_exe32.exe	28
PID 2028 wrote to memory of 2576	2028	980f14d3a22267d778dc09382aef4f60_exe32.exe	28
PID 2028 wrote to memory of 2576	2028	980f14d3a22267d778dc09382aef4f60_exe32.exe	28
PID 2028 wrote to memory of 2576	2028	980f14d3a22267d778dc09382aef4f60_exe32.exe	28
PID 2028 wrote to memory of 2576	2028	980f14d3a22267d778dc09382aef4f60_exe32.exe	28
PID 2028 wrote to memory of 2576	2028	980f14d3a22267d778dc09382aef4f60_exe32.exe	28

C:\Users\Admin\AppData\Local\Temp\980f14d3a22267d778dc09382aef4f60_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\980f14d3a22267d778dc09382aef4f60_exe32.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\980f14d3a22267d778dc09382aef4f60_exe32.exe
  C:\Users\Admin\AppData\Local\Temp\980f14d3a22267d778dc09382aef4f60_exe32.exe
  2⤵
  PID:2576

memory/2028-0-0x0000000000400000-0x0000000000669000-memory.dmp

Filesize
2.4MB

Download
memory/2028-5-0x0000000000400000-0x0000000000669000-memory.dmp

Filesize
2.4MB

Download
memory/2576-3-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2576-6-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2576-7-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2576-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download