4a6785c13a980b761cdb742975d5e573e072d622c9e4ffdd3af16f2624be2c75

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 08:23

Target

11be724bb9e0be047956c3d4549845d3.exe
Size

200KB
MD5

11be724bb9e0be047956c3d4549845d3
SHA1

bbfa376b1cf8adf64c1646f50a8208ee11c69a7b
SHA256

4a6785c13a980b761cdb742975d5e573e072d622c9e4ffdd3af16f2624be2c75
SHA512

7fbbd99df73358805003153657b1655123707d7902fa2a06ddbbb983852246bf93b1703813aa54c7a858593196e48b658368aac8fe1a5c22e8185d22ab9d6687
SSDEEP

1536:5fuDBNMuKN2EIrS9QRu7YwlS0/4kwHuTthFzBg0UE9xmAsm4Yr68QIy8KdB2i6x0:RSMUPS9+6jU0/2yKTSmFYr6ZHX56x0

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3864-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/3864-8-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3864 set thread context of 2276	3864	11be724bb9e0be047956c3d4549845d3.exe	88
PID 3864 set thread context of 0	3864	11be724bb9e0be047956c3d4549845d3.exe
PID 3864 set thread context of 0	3864	11be724bb9e0be047956c3d4549845d3.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3864	11be724bb9e0be047956c3d4549845d3.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 2276	3864	11be724bb9e0be047956c3d4549845d3.exe	88
PID 3864 wrote to memory of 2276	3864	11be724bb9e0be047956c3d4549845d3.exe	88
PID 3864 wrote to memory of 2276	3864	11be724bb9e0be047956c3d4549845d3.exe	88
PID 3864 wrote to memory of 2276	3864	11be724bb9e0be047956c3d4549845d3.exe	88
PID 3864 wrote to memory of 2276	3864	11be724bb9e0be047956c3d4549845d3.exe	88
PID 3864 wrote to memory of 2276	3864	11be724bb9e0be047956c3d4549845d3.exe	88
PID 3864 wrote to memory of 2276	3864	11be724bb9e0be047956c3d4549845d3.exe	88
PID 3864 wrote to memory of 0	3864	11be724bb9e0be047956c3d4549845d3.exe
PID 3864 wrote to memory of 0	3864	11be724bb9e0be047956c3d4549845d3.exe
PID 3864 wrote to memory of 0	3864	11be724bb9e0be047956c3d4549845d3.exe
PID 3864 wrote to memory of 0	3864	11be724bb9e0be047956c3d4549845d3.exe
PID 3864 wrote to memory of 0	3864	11be724bb9e0be047956c3d4549845d3.exe
PID 3864 wrote to memory of 0	3864	11be724bb9e0be047956c3d4549845d3.exe
PID 3864 wrote to memory of 0	3864	11be724bb9e0be047956c3d4549845d3.exe
PID 3864 wrote to memory of 0	3864	11be724bb9e0be047956c3d4549845d3.exe
PID 2276 wrote to memory of 3556	2276	11be724bb9e0be047956c3d4549845d3.exe	50
PID 2276 wrote to memory of 3556	2276	11be724bb9e0be047956c3d4549845d3.exe	50
PID 2276 wrote to memory of 3556	2276	11be724bb9e0be047956c3d4549845d3.exe	50
PID 2276 wrote to memory of 3556	2276	11be724bb9e0be047956c3d4549845d3.exe	50

memory/2276-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2276-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2276-6-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2276-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2276-9-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2276-17-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2276-16-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3556-11-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3556-12-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3864-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/3864-8-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download