cf232bd08938298920949002a6ba6b206ada3122f29740964b8bad285b15be1c

Analysis

max time kernel
131s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:54

Target

237e3cf9f73108ae0b3a97c4270d9acb.exe
Size

115KB
MD5

237e3cf9f73108ae0b3a97c4270d9acb
SHA1

c9565d3017a589bf2c70939b469c9a783ae3dbde
SHA256

cf232bd08938298920949002a6ba6b206ada3122f29740964b8bad285b15be1c
SHA512

3adb15254745a45b7ab43d4cd38712f8d1cb6aec4974afcf7d17a9c3566e2bc12509c7e13392ea6374c4dd063b43db98c756fce2de6cb0795d4528ef75b4e53e
SSDEEP

3072:R7DBfijNw+oxsbh6mjmt+R7Cl6UKe8h7ep:KFo8/Sg5Hhip

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2776-11-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/2776-9-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/2776-6-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/2776-4-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 816 set thread context of 2776	816	237e3cf9f73108ae0b3a97c4270d9acb.exe	20

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	2776	WerFault.exe	20

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
816	237e3cf9f73108ae0b3a97c4270d9acb.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2776	816	237e3cf9f73108ae0b3a97c4270d9acb.exe	20
PID 816 wrote to memory of 2776	816	237e3cf9f73108ae0b3a97c4270d9acb.exe	20
PID 816 wrote to memory of 2776	816	237e3cf9f73108ae0b3a97c4270d9acb.exe	20
PID 816 wrote to memory of 2776	816	237e3cf9f73108ae0b3a97c4270d9acb.exe	20
PID 816 wrote to memory of 2776	816	237e3cf9f73108ae0b3a97c4270d9acb.exe	20
PID 816 wrote to memory of 2776	816	237e3cf9f73108ae0b3a97c4270d9acb.exe	20
PID 816 wrote to memory of 2776	816	237e3cf9f73108ae0b3a97c4270d9acb.exe	20
PID 816 wrote to memory of 2776	816	237e3cf9f73108ae0b3a97c4270d9acb.exe	20
PID 2776 wrote to memory of 2192	2776	237e3cf9f73108ae0b3a97c4270d9acb.exe	21
PID 2776 wrote to memory of 2192	2776	237e3cf9f73108ae0b3a97c4270d9acb.exe	21
PID 2776 wrote to memory of 2192	2776	237e3cf9f73108ae0b3a97c4270d9acb.exe	21
PID 2776 wrote to memory of 2192	2776	237e3cf9f73108ae0b3a97c4270d9acb.exe	21

memory/2776-11-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2776-9-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2776-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2776-6-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2776-4-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2776-2-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download