4a6785c13a980b761cdb742975d5e573e072d622c9e4ffdd3af16f2624be2c75

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:23

Target

11be724bb9e0be047956c3d4549845d3.exe
Size

200KB
MD5

11be724bb9e0be047956c3d4549845d3
SHA1

bbfa376b1cf8adf64c1646f50a8208ee11c69a7b
SHA256

4a6785c13a980b761cdb742975d5e573e072d622c9e4ffdd3af16f2624be2c75
SHA512

7fbbd99df73358805003153657b1655123707d7902fa2a06ddbbb983852246bf93b1703813aa54c7a858593196e48b658368aac8fe1a5c22e8185d22ab9d6687
SSDEEP

1536:5fuDBNMuKN2EIrS9QRu7YwlS0/4kwHuTthFzBg0UE9xmAsm4Yr68QIy8KdB2i6x0:RSMUPS9+6jU0/2yKTSmFYr6ZHX56x0

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2468-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2468-6-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2468 set thread context of 296	2468	11be724bb9e0be047956c3d4549845d3.exe	28
PID 2468 set thread context of 0	2468	11be724bb9e0be047956c3d4549845d3.exe
PID 2468 set thread context of 0	2468	11be724bb9e0be047956c3d4549845d3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
296	11be724bb9e0be047956c3d4549845d3.exe
296	11be724bb9e0be047956c3d4549845d3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2468	11be724bb9e0be047956c3d4549845d3.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 296	2468	11be724bb9e0be047956c3d4549845d3.exe	28
PID 2468 wrote to memory of 296	2468	11be724bb9e0be047956c3d4549845d3.exe	28
PID 2468 wrote to memory of 296	2468	11be724bb9e0be047956c3d4549845d3.exe	28
PID 2468 wrote to memory of 296	2468	11be724bb9e0be047956c3d4549845d3.exe	28
PID 2468 wrote to memory of 296	2468	11be724bb9e0be047956c3d4549845d3.exe	28
PID 2468 wrote to memory of 296	2468	11be724bb9e0be047956c3d4549845d3.exe	28
PID 2468 wrote to memory of 296	2468	11be724bb9e0be047956c3d4549845d3.exe	28
PID 2468 wrote to memory of 296	2468	11be724bb9e0be047956c3d4549845d3.exe	28
PID 2468 wrote to memory of 0	2468	11be724bb9e0be047956c3d4549845d3.exe
PID 2468 wrote to memory of 0	2468	11be724bb9e0be047956c3d4549845d3.exe
PID 2468 wrote to memory of 0	2468	11be724bb9e0be047956c3d4549845d3.exe
PID 2468 wrote to memory of 0	2468	11be724bb9e0be047956c3d4549845d3.exe
PID 2468 wrote to memory of 0	2468	11be724bb9e0be047956c3d4549845d3.exe
PID 2468 wrote to memory of 0	2468	11be724bb9e0be047956c3d4549845d3.exe
PID 2468 wrote to memory of 0	2468	11be724bb9e0be047956c3d4549845d3.exe
PID 2468 wrote to memory of 0	2468	11be724bb9e0be047956c3d4549845d3.exe
PID 296 wrote to memory of 1204	296	11be724bb9e0be047956c3d4549845d3.exe	10
PID 296 wrote to memory of 1204	296	11be724bb9e0be047956c3d4549845d3.exe	10
PID 296 wrote to memory of 1204	296	11be724bb9e0be047956c3d4549845d3.exe	10
PID 296 wrote to memory of 1204	296	11be724bb9e0be047956c3d4549845d3.exe	10

memory/296-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/296-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/296-7-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/296-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/296-13-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1204-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1204-14-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2468-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2468-6-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download