40acffb5b1a787ba289e67b69ad6df790faa832e30e822ed4cab458638f4aca7 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:29

Sharing

Report Analysis Logs

General

Target

Facebook-JPG-IMG-April15.exe
Size

153KB
MD5

5149631791ebb97b544058cd321e6db9
SHA1

5ea0b2525621b27efc15b20e2004116c4495e713
SHA256

28754cb6aabe6bf60e5ef94a6b2b79cc68516d479d9f4bcf083e9018edcb0b79
SHA512

fce57f4380a30f669ff21057957eef4c3e4813d6abc3935a02c2c2868b50c4fe0fb9f2cb7f558ad492e815f049f2c19ef97ebdb98b4ab625ab2fe0eca1e15e86
SSDEEP

3072:e99US8wbV7qgs6ND5FSCVxyHAWlS6qy7bj:G9U/wxi6ZlVgHAWlT

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3048-0-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/3048-3-0x0000000000400000-0x0000000000459000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3048	Facebook-JPG-IMG-April15.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2492	3048	Facebook-JPG-IMG-April15.exe	28
PID 3048 wrote to memory of 2492	3048	Facebook-JPG-IMG-April15.exe	28
PID 3048 wrote to memory of 2492	3048	Facebook-JPG-IMG-April15.exe	28
PID 3048 wrote to memory of 2492	3048	Facebook-JPG-IMG-April15.exe	28

C:\Users\Admin\AppData\Local\Temp\Facebook-JPG-IMG-April15.exe
"C:\Users\Admin\AppData\Local\Temp\Facebook-JPG-IMG-April15.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\Facebook-JPG-IMG-April15.exe
  "C:\Users\Admin\AppData\Local\Temp\Facebook-JPG-IMG-April15.exe"
  2⤵
  PID:2492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-0-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3048-3-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download