5a4351f2f04ed78c49d1a1e324afe58a0d56fc694324685b73144b7c7706aba5

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 15:22

Target

28fdaa2fed2ad2059b41364a98346567.exe
Size

61KB
MD5

28fdaa2fed2ad2059b41364a98346567
SHA1

4033d631d0a6d569e85deaebf9931aaf36c10352
SHA256

5a4351f2f04ed78c49d1a1e324afe58a0d56fc694324685b73144b7c7706aba5
SHA512

618a050a27b73741bf7a488a0f9f2df37c491f79faab921166b2b82ab1ceb807fba564d542909a0c3b9ddbda8f3fd370fd33d3b62ef1f0b2eeb8d4ee76ef7bf5
SSDEEP

1536:iFs3Pq0VxP46q0UdmVXknjfg0nWFIkwmkLL:Jfq0Xg6iECf+IikLL

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1352-0-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1352-6-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1352 set thread context of 2208	1352	28fdaa2fed2ad2059b41364a98346567.exe	19
PID 1352 set thread context of 0	1352	28fdaa2fed2ad2059b41364a98346567.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1352	28fdaa2fed2ad2059b41364a98346567.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 2208	1352	28fdaa2fed2ad2059b41364a98346567.exe	19
PID 1352 wrote to memory of 2208	1352	28fdaa2fed2ad2059b41364a98346567.exe	19
PID 1352 wrote to memory of 2208	1352	28fdaa2fed2ad2059b41364a98346567.exe	19
PID 1352 wrote to memory of 2208	1352	28fdaa2fed2ad2059b41364a98346567.exe	19
PID 1352 wrote to memory of 2208	1352	28fdaa2fed2ad2059b41364a98346567.exe	19
PID 1352 wrote to memory of 2208	1352	28fdaa2fed2ad2059b41364a98346567.exe	19
PID 1352 wrote to memory of 2208	1352	28fdaa2fed2ad2059b41364a98346567.exe	19
PID 1352 wrote to memory of 0	1352	28fdaa2fed2ad2059b41364a98346567.exe
PID 1352 wrote to memory of 0	1352	28fdaa2fed2ad2059b41364a98346567.exe
PID 1352 wrote to memory of 0	1352	28fdaa2fed2ad2059b41364a98346567.exe
PID 1352 wrote to memory of 0	1352	28fdaa2fed2ad2059b41364a98346567.exe
PID 2208 wrote to memory of 3504	2208	28fdaa2fed2ad2059b41364a98346567.exe	49
PID 2208 wrote to memory of 3504	2208	28fdaa2fed2ad2059b41364a98346567.exe	49
PID 2208 wrote to memory of 3504	2208	28fdaa2fed2ad2059b41364a98346567.exe	49
PID 2208 wrote to memory of 3504	2208	28fdaa2fed2ad2059b41364a98346567.exe	49

memory/1352-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1352-6-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2208-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-8-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2208-15-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2208-13-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/3504-9-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3504-10-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download