05bf73d4876e1595040679e8d3456750da04decc7e9571fa9436de9b114ffc3a

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:00

Target

108be86bb9941bf315c53efdaf6a0760.exe
Size

914KB
MD5

108be86bb9941bf315c53efdaf6a0760
SHA1

161625eca9fab759a3b03f239c36ad931d1c476c
SHA256

05bf73d4876e1595040679e8d3456750da04decc7e9571fa9436de9b114ffc3a
SHA512

685608a1ceb76e9561f4833bca54c5895a3dfc84bb374538949957dd37d207f02a55cad429b7220af65aa105579d02e40357b63bb2ffca9faa7f8eb5a1f5d002
SSDEEP

24576:0A5agxqq5lJWH3gDBo76grJgZIqzV+ZPPpfd:0APAemIB26sqKyVkPFd

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2220-0-0x0000000010000000-0x00000000100A5000-memory.dmp	upx
behavioral1/memory/2896-9-0x0000000010000000-0x00000000100A5000-memory.dmp	upx
behavioral1/memory/2220-11-0x0000000010000000-0x00000000100A5000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2220 set thread context of 2896	2220	108be86bb9941bf315c53efdaf6a0760.exe	15

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2896	108be86bb9941bf315c53efdaf6a0760.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2896	2220	108be86bb9941bf315c53efdaf6a0760.exe	15
PID 2220 wrote to memory of 2896	2220	108be86bb9941bf315c53efdaf6a0760.exe	15
PID 2220 wrote to memory of 2896	2220	108be86bb9941bf315c53efdaf6a0760.exe	15
PID 2220 wrote to memory of 2896	2220	108be86bb9941bf315c53efdaf6a0760.exe	15
PID 2220 wrote to memory of 2896	2220	108be86bb9941bf315c53efdaf6a0760.exe	15
PID 2220 wrote to memory of 2896	2220	108be86bb9941bf315c53efdaf6a0760.exe	15

C:\Users\Admin\AppData\Local\Temp\108be86bb9941bf315c53efdaf6a0760.exe
"C:\Users\Admin\AppData\Local\Temp\108be86bb9941bf315c53efdaf6a0760.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\108be86bb9941bf315c53efdaf6a0760.exe
  C:\Users\Admin\AppData\Local\Temp\108be86bb9941bf315c53efdaf6a0760.exe
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2896

memory/2220-0-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/2220-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2220-11-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/2220-4-0x0000000002CA0000-0x0000000002D45000-memory.dmp

Filesize
660KB

Download
memory/2896-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2896-10-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2896-9-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/2896-7-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2896-13-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2896-12-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2896-2-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2896-14-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2896-15-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download