05bf73d4876e1595040679e8d3456750da04decc7e9571fa9436de9b114ffc3a

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 06:00

Target

108be86bb9941bf315c53efdaf6a0760.exe
Size

914KB
MD5

108be86bb9941bf315c53efdaf6a0760
SHA1

161625eca9fab759a3b03f239c36ad931d1c476c
SHA256

05bf73d4876e1595040679e8d3456750da04decc7e9571fa9436de9b114ffc3a
SHA512

685608a1ceb76e9561f4833bca54c5895a3dfc84bb374538949957dd37d207f02a55cad429b7220af65aa105579d02e40357b63bb2ffca9faa7f8eb5a1f5d002
SSDEEP

24576:0A5agxqq5lJWH3gDBo76grJgZIqzV+ZPPpfd:0APAemIB26sqKyVkPFd

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1344-0-0x0000000010000000-0x00000000100A5000-memory.dmp	upx
behavioral2/memory/1344-7-0x0000000010000000-0x00000000100A5000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1344 set thread context of 2672	1344	108be86bb9941bf315c53efdaf6a0760.exe	32

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2672	108be86bb9941bf315c53efdaf6a0760.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2672	1344	108be86bb9941bf315c53efdaf6a0760.exe	32
PID 1344 wrote to memory of 2672	1344	108be86bb9941bf315c53efdaf6a0760.exe	32
PID 1344 wrote to memory of 2672	1344	108be86bb9941bf315c53efdaf6a0760.exe	32
PID 1344 wrote to memory of 2672	1344	108be86bb9941bf315c53efdaf6a0760.exe	32
PID 1344 wrote to memory of 2672	1344	108be86bb9941bf315c53efdaf6a0760.exe	32

C:\Users\Admin\AppData\Local\Temp\108be86bb9941bf315c53efdaf6a0760.exe
"C:\Users\Admin\AppData\Local\Temp\108be86bb9941bf315c53efdaf6a0760.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Local\Temp\108be86bb9941bf315c53efdaf6a0760.exe
  C:\Users\Admin\AppData\Local\Temp\108be86bb9941bf315c53efdaf6a0760.exe
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2672

memory/1344-0-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/1344-1-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/1344-7-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/2672-2-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2672-4-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2672-6-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/2672-5-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2672-8-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2672-9-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download