510f25efe306f315dd70ef7885edd3522317c779c04c498218c8689e57bf4b9e

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:55

Target

255bed65d1aee27d765ce4492fc9ecd1.exe
Size

231KB
MD5

255bed65d1aee27d765ce4492fc9ecd1
SHA1

f1d1df176835514bd61269483c3e12c2f538f342
SHA256

510f25efe306f315dd70ef7885edd3522317c779c04c498218c8689e57bf4b9e
SHA512

21593148e49d7cc8b200fd1236ec5f0b28d09946773fdc9f39d2059059c48ff595676516b6c0176d011bb664626f373e9dbb8d5e8d5a9a5ddea47c222bb61f83
SSDEEP

6144:I2nVKfRwc6AqLKjAZcLraBCDoyAJBRI/K+:B8p1qLMAyraBO/K+

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2928-0-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2928-1-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2928-3-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2928-7-0x0000000000400000-0x000000000048C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2928 set thread context of 3044	2928	255bed65d1aee27d765ce4492fc9ecd1.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3044	255bed65d1aee27d765ce4492fc9ecd1.exe
3044	255bed65d1aee27d765ce4492fc9ecd1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2928	255bed65d1aee27d765ce4492fc9ecd1.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3044	2928	255bed65d1aee27d765ce4492fc9ecd1.exe	28
PID 2928 wrote to memory of 3044	2928	255bed65d1aee27d765ce4492fc9ecd1.exe	28
PID 2928 wrote to memory of 3044	2928	255bed65d1aee27d765ce4492fc9ecd1.exe	28
PID 2928 wrote to memory of 3044	2928	255bed65d1aee27d765ce4492fc9ecd1.exe	28
PID 2928 wrote to memory of 3044	2928	255bed65d1aee27d765ce4492fc9ecd1.exe	28
PID 2928 wrote to memory of 3044	2928	255bed65d1aee27d765ce4492fc9ecd1.exe	28
PID 2928 wrote to memory of 3044	2928	255bed65d1aee27d765ce4492fc9ecd1.exe	28
PID 2928 wrote to memory of 3044	2928	255bed65d1aee27d765ce4492fc9ecd1.exe	28
PID 3044 wrote to memory of 1216	3044	255bed65d1aee27d765ce4492fc9ecd1.exe	7
PID 3044 wrote to memory of 1216	3044	255bed65d1aee27d765ce4492fc9ecd1.exe	7
PID 3044 wrote to memory of 1216	3044	255bed65d1aee27d765ce4492fc9ecd1.exe	7
PID 3044 wrote to memory of 1216	3044	255bed65d1aee27d765ce4492fc9ecd1.exe	7

memory/1216-16-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1216-12-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2928-8-0x00000000009F0000-0x0000000000A7C000-memory.dmp

Filesize
560KB

Download
memory/2928-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2928-3-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2928-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2928-7-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3044-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3044-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3044-10-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3044-14-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3044-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3044-26-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download