40acffb5b1a787ba289e67b69ad6df790faa832e30e822ed4cab458638f4aca7 | Triage

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 23:29

Sharing

Report Analysis Logs

General

Target

Facebook-JPG-IMG-April15.exe
Size

153KB
MD5

5149631791ebb97b544058cd321e6db9
SHA1

5ea0b2525621b27efc15b20e2004116c4495e713
SHA256

28754cb6aabe6bf60e5ef94a6b2b79cc68516d479d9f4bcf083e9018edcb0b79
SHA512

fce57f4380a30f669ff21057957eef4c3e4813d6abc3935a02c2c2868b50c4fe0fb9f2cb7f558ad492e815f049f2c19ef97ebdb98b4ab625ab2fe0eca1e15e86
SSDEEP

3072:e99US8wbV7qgs6ND5FSCVxyHAWlS6qy7bj:G9U/wxi6ZlVgHAWlT

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1740-0-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/1740-3-0x0000000000400000-0x0000000000459000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1740	Facebook-JPG-IMG-April15.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 396	1740	Facebook-JPG-IMG-April15.exe	38
PID 1740 wrote to memory of 396	1740	Facebook-JPG-IMG-April15.exe	38
PID 1740 wrote to memory of 396	1740	Facebook-JPG-IMG-April15.exe	38

C:\Users\Admin\AppData\Local\Temp\Facebook-JPG-IMG-April15.exe
"C:\Users\Admin\AppData\Local\Temp\Facebook-JPG-IMG-April15.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\AppData\Local\Temp\Facebook-JPG-IMG-April15.exe
  "C:\Users\Admin\AppData\Local\Temp\Facebook-JPG-IMG-April15.exe"
  2⤵
  PID:396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-0-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1740-3-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download