c103376d0fe9ad00327b7367bf6c4dbb384ba019ea410e452460f94578a64270

Analysis

max time kernel
123s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 15:21

Target

788e2544756c4bf26a814846aa9b952f.exe
Size

98KB
MD5

788e2544756c4bf26a814846aa9b952f
SHA1

3548cd81b5b7ec4af2c89c3981293fbc887aefe0
SHA256

c103376d0fe9ad00327b7367bf6c4dbb384ba019ea410e452460f94578a64270
SHA512

96eccac6a832cb6a9e6e8d742769ecd024c7f68c26e9640ba99919a2c767577b8bc6e9a7185a4e56c8bb415187163aa78e6b82b354c3ec13dc8a8d6d5593700e
SSDEEP

1536:ihgIo0Du4UeWTg5+qcTQpzFIRUsWkerHsZZ/5k80LafoNlQxsgy:XIo064UG5+pYFIRjuM7ixagjRgy

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/216-0-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/216-6-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 216 set thread context of 3908	216	788e2544756c4bf26a814846aa9b952f.exe	86

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
216	788e2544756c4bf26a814846aa9b952f.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 3908	216	788e2544756c4bf26a814846aa9b952f.exe	86
PID 216 wrote to memory of 3908	216	788e2544756c4bf26a814846aa9b952f.exe	86
PID 216 wrote to memory of 3908	216	788e2544756c4bf26a814846aa9b952f.exe	86
PID 216 wrote to memory of 3908	216	788e2544756c4bf26a814846aa9b952f.exe	86
PID 216 wrote to memory of 3908	216	788e2544756c4bf26a814846aa9b952f.exe	86
PID 216 wrote to memory of 3908	216	788e2544756c4bf26a814846aa9b952f.exe	86
PID 216 wrote to memory of 3908	216	788e2544756c4bf26a814846aa9b952f.exe	86
PID 3908 wrote to memory of 3468	3908	788e2544756c4bf26a814846aa9b952f.exe	37
PID 3908 wrote to memory of 3468	3908	788e2544756c4bf26a814846aa9b952f.exe	37
PID 3908 wrote to memory of 3468	3908	788e2544756c4bf26a814846aa9b952f.exe	37
PID 3908 wrote to memory of 3468	3908	788e2544756c4bf26a814846aa9b952f.exe	37

memory/216-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/216-6-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3468-9-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3468-10-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3908-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3908-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3908-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3908-8-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3908-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3908-15-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download