260d8e26a5cd3ae95cc33305e4aa6f5ff986d382dc0018db209b8c307cbb84b4

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:06

Target

040288a2b9c957425f004f9941024731.exe
Size

68KB
MD5

040288a2b9c957425f004f9941024731
SHA1

7768c3f0274a72b88ad4f6b50f5133b03dea71c4
SHA256

260d8e26a5cd3ae95cc33305e4aa6f5ff986d382dc0018db209b8c307cbb84b4
SHA512

2ea5f8dcbbd4e40d1d7ab0765983fc2215ddcf5a2bc111a867432e2af4ad45b47b306eb3cfa506c1e70ec6d69e935d395d30a8ac132ca6cae766fc52688c73ab
SSDEEP

1536:+q21+CD/g96fmjXbgE4XG0j1R8Qjsv4Eu/Kee:01+CD/BuoZD5Rvze

Score

7^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1784-3-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1784-6-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1784-7-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1784-8-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1784-9-0x0000000000400000-0x000000000044A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 1784	1588	040288a2b9c957425f004f9941024731.exe	28

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1784	1588	040288a2b9c957425f004f9941024731.exe	28
PID 1588 wrote to memory of 1784	1588	040288a2b9c957425f004f9941024731.exe	28
PID 1588 wrote to memory of 1784	1588	040288a2b9c957425f004f9941024731.exe	28
PID 1588 wrote to memory of 1784	1588	040288a2b9c957425f004f9941024731.exe	28
PID 1588 wrote to memory of 1784	1588	040288a2b9c957425f004f9941024731.exe	28
PID 1588 wrote to memory of 1784	1588	040288a2b9c957425f004f9941024731.exe	28

C:\Users\Admin\AppData\Local\Temp\040288a2b9c957425f004f9941024731.exe
"C:\Users\Admin\AppData\Local\Temp\040288a2b9c957425f004f9941024731.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Local\Temp\040288a2b9c957425f004f9941024731.exe
  C:\Users\Admin\AppData\Local\Temp\040288a2b9c957425f004f9941024731.exe
  2⤵
  PID:1784

memory/1588-4-0x0000000013140000-0x0000000013158000-memory.dmp

Filesize
96KB

Download
memory/1784-0-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1784-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1784-3-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1784-6-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1784-7-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1784-8-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1784-9-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download