cca89c688445772ea030d187a1c806495f637217c41560ffcfae196d20084015

Analysis

max time kernel
143s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:42

Target

12b761608298b3404ce62de81f982290.exe
Size

866KB
MD5

12b761608298b3404ce62de81f982290
SHA1

5545bb2930cf7b78b76e5110b6f0afcb46f6b614
SHA256

cca89c688445772ea030d187a1c806495f637217c41560ffcfae196d20084015
SHA512

7a7d39357e849bc192c0a0686deea98e8e36767f9bd76b03f3fc96b024edab5423ea7c2eceb9d68958d62cac7ab8d12d347256930b44d2438055a8a8fc83f25c
SSDEEP

12288:hFN2AEbz0WF48jO7gHUTaO9C39SBN3KRSCiYRR/eZxNGFHISJ7NHkO:/cbz0SF0FkSBNp6RKFSEO

Score

7^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2504-3-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/2504-5-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/2504-8-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/2504-10-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/2504-11-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/2504-13-0x0000000000400000-0x00000000004E9000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2224 set thread context of 2504	2224	12b761608298b3404ce62de81f982290.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	2504	WerFault.exe	28

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2504	2224	12b761608298b3404ce62de81f982290.exe	28
PID 2224 wrote to memory of 2504	2224	12b761608298b3404ce62de81f982290.exe	28
PID 2224 wrote to memory of 2504	2224	12b761608298b3404ce62de81f982290.exe	28
PID 2224 wrote to memory of 2504	2224	12b761608298b3404ce62de81f982290.exe	28
PID 2224 wrote to memory of 2504	2224	12b761608298b3404ce62de81f982290.exe	28
PID 2224 wrote to memory of 2504	2224	12b761608298b3404ce62de81f982290.exe	28
PID 2224 wrote to memory of 2504	2224	12b761608298b3404ce62de81f982290.exe	28
PID 2224 wrote to memory of 2504	2224	12b761608298b3404ce62de81f982290.exe	28
PID 2504 wrote to memory of 2308	2504	12b761608298b3404ce62de81f982290.exe	29
PID 2504 wrote to memory of 2308	2504	12b761608298b3404ce62de81f982290.exe	29
PID 2504 wrote to memory of 2308	2504	12b761608298b3404ce62de81f982290.exe	29
PID 2504 wrote to memory of 2308	2504	12b761608298b3404ce62de81f982290.exe	29

memory/2504-3-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/2504-1-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/2504-5-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/2504-8-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/2504-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2504-10-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/2504-11-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/2504-13-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download