7c4a0516fcd37659e9009bc4f680c24007c06ade8dac1335e967999ef13869db

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:25

Target

22d5c026dffd72109093d842c4aa2554.exe
Size

6KB
MD5

22d5c026dffd72109093d842c4aa2554
SHA1

a0de047bcc878e9d2e9c9e205822db7cffb5ca50
SHA256

7c4a0516fcd37659e9009bc4f680c24007c06ade8dac1335e967999ef13869db
SHA512

19966c53f6d4a0a7f3236af3d73af7310bd80e81b921cbf7103ddbf92ad4d5879ac6f6155547cd2295a8e122b33bd0d87b0c4e5bf9e73aff49475163091601c4
SSDEEP

96:TxkcAcQJZ+YMqRZ3ahcpoOEzSmj3OEzckE8PJS+kC5SqS3a:izc2lMqRZ3qcmQmj3pfE8PA+75t3

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
292	explorer.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3052-0-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3052-1-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3052 set thread context of 292	3052	22d5c026dffd72109093d842c4aa2554.exe	33

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 292	3052	22d5c026dffd72109093d842c4aa2554.exe	33
PID 3052 wrote to memory of 292	3052	22d5c026dffd72109093d842c4aa2554.exe	33
PID 3052 wrote to memory of 292	3052	22d5c026dffd72109093d842c4aa2554.exe	33
PID 3052 wrote to memory of 292	3052	22d5c026dffd72109093d842c4aa2554.exe	33
PID 3052 wrote to memory of 292	3052	22d5c026dffd72109093d842c4aa2554.exe	33

C:\Users\Admin\AppData\Local\Temp\22d5c026dffd72109093d842c4aa2554.exe
"C:\Users\Admin\AppData\Local\Temp\22d5c026dffd72109093d842c4aa2554.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Deletes itself
  PID:292

memory/3052-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3052-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download