a8f1bd2044910f8765385ecbe10d5641297d25e14551de01c6476440a2ab2b19

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:11

Target

18608588f1bcb8e9ed629a70f60ccfd0.exe
Size

40KB
MD5

18608588f1bcb8e9ed629a70f60ccfd0
SHA1

5b0cf9a48644a2c70de43983a39140baf9c72d8c
SHA256

a8f1bd2044910f8765385ecbe10d5641297d25e14551de01c6476440a2ab2b19
SHA512

00853d3b1f64223d7d5395d367c635577db0deace8e7fcf33e644999b1f28f128b5ec2ffd2e7dfbfa7e1af11bbf75991f3d441b3da9d762a1f3104aea0d51ffb
SSDEEP

384:gi3W4EuLHXIWZjWAZDKtZM24hweHalppRbFGP+vSe3ReUm8jvg6pp:xbEqFeEjOeHEFK+KQE8jF

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2248-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2248-16-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2248 set thread context of 1544	2248	18608588f1bcb8e9ed629a70f60ccfd0.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2248	18608588f1bcb8e9ed629a70f60ccfd0.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1544	2248	18608588f1bcb8e9ed629a70f60ccfd0.exe	28
PID 2248 wrote to memory of 1544	2248	18608588f1bcb8e9ed629a70f60ccfd0.exe	28
PID 2248 wrote to memory of 1544	2248	18608588f1bcb8e9ed629a70f60ccfd0.exe	28
PID 2248 wrote to memory of 1544	2248	18608588f1bcb8e9ed629a70f60ccfd0.exe	28
PID 2248 wrote to memory of 1544	2248	18608588f1bcb8e9ed629a70f60ccfd0.exe	28
PID 2248 wrote to memory of 1544	2248	18608588f1bcb8e9ed629a70f60ccfd0.exe	28
PID 2248 wrote to memory of 1544	2248	18608588f1bcb8e9ed629a70f60ccfd0.exe	28
PID 2248 wrote to memory of 1544	2248	18608588f1bcb8e9ed629a70f60ccfd0.exe	28
PID 2248 wrote to memory of 1544	2248	18608588f1bcb8e9ed629a70f60ccfd0.exe	28

C:\Users\Admin\AppData\Local\Temp\18608588f1bcb8e9ed629a70f60ccfd0.exe
"C:\Users\Admin\AppData\Local\Temp\18608588f1bcb8e9ed629a70f60ccfd0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\18608588f1bcb8e9ed629a70f60ccfd0.exe
  2⤵
  PID:1544

memory/1544-17-0x0000000000400000-0x0000000000401C00-memory.dmp

Filesize
7KB

Download
memory/1544-14-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1544-13-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1544-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1544-9-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1544-7-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1544-5-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1544-3-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2248-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2248-16-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download