260d8e26a5cd3ae95cc33305e4aa6f5ff986d382dc0018db209b8c307cbb84b4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 21:06

Target

040288a2b9c957425f004f9941024731.exe
Size

68KB
MD5

040288a2b9c957425f004f9941024731
SHA1

7768c3f0274a72b88ad4f6b50f5133b03dea71c4
SHA256

260d8e26a5cd3ae95cc33305e4aa6f5ff986d382dc0018db209b8c307cbb84b4
SHA512

2ea5f8dcbbd4e40d1d7ab0765983fc2215ddcf5a2bc111a867432e2af4ad45b47b306eb3cfa506c1e70ec6d69e935d395d30a8ac132ca6cae766fc52688c73ab
SSDEEP

1536:+q21+CD/g96fmjXbgE4XG0j1R8Qjsv4Eu/Kee:01+CD/BuoZD5Rvze

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5016-5-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral2/memory/5016-4-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral2/memory/5016-3-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral2/memory/5016-0-0x0000000000400000-0x000000000044A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4004 set thread context of 5016	4004	040288a2b9c957425f004f9941024731.exe	14

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 5016	4004	040288a2b9c957425f004f9941024731.exe	14
PID 4004 wrote to memory of 5016	4004	040288a2b9c957425f004f9941024731.exe	14
PID 4004 wrote to memory of 5016	4004	040288a2b9c957425f004f9941024731.exe	14
PID 4004 wrote to memory of 5016	4004	040288a2b9c957425f004f9941024731.exe	14
PID 4004 wrote to memory of 5016	4004	040288a2b9c957425f004f9941024731.exe	14

C:\Users\Admin\AppData\Local\Temp\040288a2b9c957425f004f9941024731.exe
"C:\Users\Admin\AppData\Local\Temp\040288a2b9c957425f004f9941024731.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Users\Admin\AppData\Local\Temp\040288a2b9c957425f004f9941024731.exe
  C:\Users\Admin\AppData\Local\Temp\040288a2b9c957425f004f9941024731.exe
  2⤵
  PID:5016

memory/4004-2-0x0000000013140000-0x0000000013158000-memory.dmp

Filesize
96KB

Download
memory/5016-5-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/5016-4-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/5016-3-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/5016-0-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download