21999b251161e67213d0fd5dbaedf732f62875ff6c939c8ac46469b7afd58549

Analysis

max time kernel
13s
max time network
30s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:27

Target

088ada5e03479e8d32491c03b0868ccc.exe
Size

119KB
MD5

088ada5e03479e8d32491c03b0868ccc
SHA1

656c75782966240e7d8683c82d3aca04e7d54539
SHA256

21999b251161e67213d0fd5dbaedf732f62875ff6c939c8ac46469b7afd58549
SHA512

c940f9d4496ce66b7e3ee85f3160b2fed5a91a0e767fb1c0d56bb808aab981f64358a0a36753efd8d9274c290f9be04412663d5efed6d9b9f90eceb6a34ffbf4
SSDEEP

1536:yGsHJmbfNj+jd6Yb6Y+CPxtZqiHTjrgvxhX5a5eiJFtmpMtb7e3DSMJsOhhcwHzK:yGsHI1j+sc+BiHTAQ5TFtrsnJs6gpu4

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2156-0-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2156-1-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2156-3-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2156-10-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2156 set thread context of 2056	2156	088ada5e03479e8d32491c03b0868ccc.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2056	088ada5e03479e8d32491c03b0868ccc.exe
2056	088ada5e03479e8d32491c03b0868ccc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2156	088ada5e03479e8d32491c03b0868ccc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2056	2156	088ada5e03479e8d32491c03b0868ccc.exe	28
PID 2156 wrote to memory of 2056	2156	088ada5e03479e8d32491c03b0868ccc.exe	28
PID 2156 wrote to memory of 2056	2156	088ada5e03479e8d32491c03b0868ccc.exe	28
PID 2156 wrote to memory of 2056	2156	088ada5e03479e8d32491c03b0868ccc.exe	28
PID 2156 wrote to memory of 2056	2156	088ada5e03479e8d32491c03b0868ccc.exe	28
PID 2156 wrote to memory of 2056	2156	088ada5e03479e8d32491c03b0868ccc.exe	28
PID 2156 wrote to memory of 2056	2156	088ada5e03479e8d32491c03b0868ccc.exe	28
PID 2156 wrote to memory of 2056	2156	088ada5e03479e8d32491c03b0868ccc.exe	28
PID 2056 wrote to memory of 1244	2056	088ada5e03479e8d32491c03b0868ccc.exe	12
PID 2056 wrote to memory of 1244	2056	088ada5e03479e8d32491c03b0868ccc.exe	12
PID 2056 wrote to memory of 1244	2056	088ada5e03479e8d32491c03b0868ccc.exe	12
PID 2056 wrote to memory of 1244	2056	088ada5e03479e8d32491c03b0868ccc.exe	12

memory/1244-12-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1244-15-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2056-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2056-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2056-8-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2056-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2056-11-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2056-25-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2156-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2156-1-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2156-3-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2156-10-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download