5bb2505c0f54892d1b297a37b675cba00592d80a9abb344910cdcf651203cee7

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:29

Target

1ae370a8b4d5c3f8a57eaca8b93fca07.exe
Size

460KB
MD5

1ae370a8b4d5c3f8a57eaca8b93fca07
SHA1

a11ca4b56b1af8637514dc8fdaf7c303ee4e4c19
SHA256

5bb2505c0f54892d1b297a37b675cba00592d80a9abb344910cdcf651203cee7
SHA512

a9eab8985d0d7ec03ddd96da6658e1a3e98f89da28420dbbba9c2649762b7270f13003239445f256d8afb0b79ec79001df0c151b5a105a25a118b442c7434424
SSDEEP

6144:i4Dhp1HC0xklLyQHDV4u4sP/BWlQbXlwR3Q:fhO0pQjLnYmXl2A

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3012-0-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/3012-6-0x0000000000400000-0x0000000000459000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 2700	3012	1ae370a8b4d5c3f8a57eaca8b93fca07.exe	28
PID 3012 set thread context of 0	3012	1ae370a8b4d5c3f8a57eaca8b93fca07.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2700	1ae370a8b4d5c3f8a57eaca8b93fca07.exe
2700	1ae370a8b4d5c3f8a57eaca8b93fca07.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3012	1ae370a8b4d5c3f8a57eaca8b93fca07.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2700	3012	1ae370a8b4d5c3f8a57eaca8b93fca07.exe	28
PID 3012 wrote to memory of 2700	3012	1ae370a8b4d5c3f8a57eaca8b93fca07.exe	28
PID 3012 wrote to memory of 2700	3012	1ae370a8b4d5c3f8a57eaca8b93fca07.exe	28
PID 3012 wrote to memory of 2700	3012	1ae370a8b4d5c3f8a57eaca8b93fca07.exe	28
PID 3012 wrote to memory of 2700	3012	1ae370a8b4d5c3f8a57eaca8b93fca07.exe	28
PID 3012 wrote to memory of 2700	3012	1ae370a8b4d5c3f8a57eaca8b93fca07.exe	28
PID 3012 wrote to memory of 2700	3012	1ae370a8b4d5c3f8a57eaca8b93fca07.exe	28
PID 3012 wrote to memory of 2700	3012	1ae370a8b4d5c3f8a57eaca8b93fca07.exe	28
PID 3012 wrote to memory of 0	3012	1ae370a8b4d5c3f8a57eaca8b93fca07.exe
PID 3012 wrote to memory of 0	3012	1ae370a8b4d5c3f8a57eaca8b93fca07.exe
PID 3012 wrote to memory of 0	3012	1ae370a8b4d5c3f8a57eaca8b93fca07.exe
PID 3012 wrote to memory of 0	3012	1ae370a8b4d5c3f8a57eaca8b93fca07.exe
PID 2700 wrote to memory of 1228	2700	1ae370a8b4d5c3f8a57eaca8b93fca07.exe	17
PID 2700 wrote to memory of 1228	2700	1ae370a8b4d5c3f8a57eaca8b93fca07.exe	17
PID 2700 wrote to memory of 1228	2700	1ae370a8b4d5c3f8a57eaca8b93fca07.exe	17
PID 2700 wrote to memory of 1228	2700	1ae370a8b4d5c3f8a57eaca8b93fca07.exe	17

memory/1228-11-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1228-14-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2700-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2700-7-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2700-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2700-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2700-10-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2700-24-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2700-25-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3012-0-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3012-4-0x0000000000460000-0x00000000004B9000-memory.dmp

Filesize
356KB

Download
memory/3012-6-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download