bd2527cc309a1d757d4168ffb8e1347967a6eb9c0fc7daedc5bdc29b2e031c76

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 14:54

Target

77208231e3dd20c5feec89c9fe8d7f5c.exe
Size

39KB
MD5

77208231e3dd20c5feec89c9fe8d7f5c
SHA1

528771229895ac316d5a465d4c52609a0b2aa2a0
SHA256

bd2527cc309a1d757d4168ffb8e1347967a6eb9c0fc7daedc5bdc29b2e031c76
SHA512

b0d085d99d20d052494de187854b3ce537de4266685cdd55c65f0b3ec4064aa1fdcaa398dfc14171c09617eb000500e834cb85d9768768a77c47f721deba3bde
SSDEEP

768:/DmVafPJmz9GuWLC96TdZmjzYnP7RhRvxrq2Y1rqXQa9:/D55mzBa7PKEFXvxrqHsAa9

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1472-0-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/1472-3-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1472	77208231e3dd20c5feec89c9fe8d7f5c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 1336	1472	77208231e3dd20c5feec89c9fe8d7f5c.exe	88
PID 1472 wrote to memory of 1336	1472	77208231e3dd20c5feec89c9fe8d7f5c.exe	88
PID 1472 wrote to memory of 1336	1472	77208231e3dd20c5feec89c9fe8d7f5c.exe	88

C:\Users\Admin\AppData\Local\Temp\77208231e3dd20c5feec89c9fe8d7f5c.exe
"C:\Users\Admin\AppData\Local\Temp\77208231e3dd20c5feec89c9fe8d7f5c.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Modifies registry class
  PID:1336

memory/1472-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1472-3-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download