5a4351f2f04ed78c49d1a1e324afe58a0d56fc694324685b73144b7c7706aba5

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:22

Target

28fdaa2fed2ad2059b41364a98346567.exe
Size

61KB
MD5

28fdaa2fed2ad2059b41364a98346567
SHA1

4033d631d0a6d569e85deaebf9931aaf36c10352
SHA256

5a4351f2f04ed78c49d1a1e324afe58a0d56fc694324685b73144b7c7706aba5
SHA512

618a050a27b73741bf7a488a0f9f2df37c491f79faab921166b2b82ab1ceb807fba564d542909a0c3b9ddbda8f3fd370fd33d3b62ef1f0b2eeb8d4ee76ef7bf5
SSDEEP

1536:iFs3Pq0VxP46q0UdmVXknjfg0nWFIkwmkLL:Jfq0Xg6iECf+IikLL

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2028-0-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2028-7-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 2236	2028	28fdaa2fed2ad2059b41364a98346567.exe	28
PID 2028 set thread context of 0	2028	28fdaa2fed2ad2059b41364a98346567.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2236	28fdaa2fed2ad2059b41364a98346567.exe
2236	28fdaa2fed2ad2059b41364a98346567.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2028	28fdaa2fed2ad2059b41364a98346567.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2236	2028	28fdaa2fed2ad2059b41364a98346567.exe	28
PID 2028 wrote to memory of 2236	2028	28fdaa2fed2ad2059b41364a98346567.exe	28
PID 2028 wrote to memory of 2236	2028	28fdaa2fed2ad2059b41364a98346567.exe	28
PID 2028 wrote to memory of 2236	2028	28fdaa2fed2ad2059b41364a98346567.exe	28
PID 2028 wrote to memory of 2236	2028	28fdaa2fed2ad2059b41364a98346567.exe	28
PID 2028 wrote to memory of 2236	2028	28fdaa2fed2ad2059b41364a98346567.exe	28
PID 2028 wrote to memory of 2236	2028	28fdaa2fed2ad2059b41364a98346567.exe	28
PID 2028 wrote to memory of 2236	2028	28fdaa2fed2ad2059b41364a98346567.exe	28
PID 2028 wrote to memory of 0	2028	28fdaa2fed2ad2059b41364a98346567.exe
PID 2028 wrote to memory of 0	2028	28fdaa2fed2ad2059b41364a98346567.exe
PID 2028 wrote to memory of 0	2028	28fdaa2fed2ad2059b41364a98346567.exe
PID 2028 wrote to memory of 0	2028	28fdaa2fed2ad2059b41364a98346567.exe
PID 2236 wrote to memory of 1212	2236	28fdaa2fed2ad2059b41364a98346567.exe	16
PID 2236 wrote to memory of 1212	2236	28fdaa2fed2ad2059b41364a98346567.exe	16
PID 2236 wrote to memory of 1212	2236	28fdaa2fed2ad2059b41364a98346567.exe	16
PID 2236 wrote to memory of 1212	2236	28fdaa2fed2ad2059b41364a98346567.exe	16

memory/1212-9-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1212-13-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2028-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2028-7-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2236-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2236-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2236-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2236-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2236-12-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download