b4640a04e900fa7a8848c8654ee995b46b3fa74cedcb85cac5337e6d0197bf27

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:21

Target

004d5b5ae24dc7b989c65c3ed15fc122.exe
Size

113KB
MD5

004d5b5ae24dc7b989c65c3ed15fc122
SHA1

a1a8f19ac949833432c54ee40d3495680da95550
SHA256

b4640a04e900fa7a8848c8654ee995b46b3fa74cedcb85cac5337e6d0197bf27
SHA512

c49c4bcd1e38f482f6ab8c40041ef9f70282c7c56e6a2d1335b4971fdd212aacf8f566884d3b397a8d5bf63aa4ebc20cc8071be6d4b6964dddb790ade939cd1c
SSDEEP

3072:GKEKmrDUskUVIKkAX/0L0rZmm1sJmvk1fiGLuNqulAN2+1log:GKE5IIL7JntNqulA1F

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2100-1-0x0000000000320000-0x000000000032D000-memory.dmp	upx
behavioral1/memory/2100-0-0x0000000000320000-0x000000000032D000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 2304	2100	004d5b5ae24dc7b989c65c3ed15fc122.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	2304	WerFault.exe	28

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2304	2100	004d5b5ae24dc7b989c65c3ed15fc122.exe	28
PID 2100 wrote to memory of 2304	2100	004d5b5ae24dc7b989c65c3ed15fc122.exe	28
PID 2100 wrote to memory of 2304	2100	004d5b5ae24dc7b989c65c3ed15fc122.exe	28
PID 2100 wrote to memory of 2304	2100	004d5b5ae24dc7b989c65c3ed15fc122.exe	28
PID 2100 wrote to memory of 2304	2100	004d5b5ae24dc7b989c65c3ed15fc122.exe	28
PID 2100 wrote to memory of 2304	2100	004d5b5ae24dc7b989c65c3ed15fc122.exe	28
PID 2304 wrote to memory of 1988	2304	004d5b5ae24dc7b989c65c3ed15fc122.exe	29
PID 2304 wrote to memory of 1988	2304	004d5b5ae24dc7b989c65c3ed15fc122.exe	29
PID 2304 wrote to memory of 1988	2304	004d5b5ae24dc7b989c65c3ed15fc122.exe	29
PID 2304 wrote to memory of 1988	2304	004d5b5ae24dc7b989c65c3ed15fc122.exe	29

memory/2100-1-0x0000000000320000-0x000000000032D000-memory.dmp

Filesize
52KB

Download
memory/2100-0-0x0000000000320000-0x000000000032D000-memory.dmp

Filesize
52KB

Download
memory/2100-7-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2304-2-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2304-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2304-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2304-8-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2304-10-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2304-11-0x0000000000400000-0x0000000000402200-memory.dmp

Filesize
8KB

Download