510f25efe306f315dd70ef7885edd3522317c779c04c498218c8689e57bf4b9e

Analysis

max time kernel
149s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 02:55

Target

255bed65d1aee27d765ce4492fc9ecd1.exe
Size

231KB
MD5

255bed65d1aee27d765ce4492fc9ecd1
SHA1

f1d1df176835514bd61269483c3e12c2f538f342
SHA256

510f25efe306f315dd70ef7885edd3522317c779c04c498218c8689e57bf4b9e
SHA512

21593148e49d7cc8b200fd1236ec5f0b28d09946773fdc9f39d2059059c48ff595676516b6c0176d011bb664626f373e9dbb8d5e8d5a9a5ddea47c222bb61f83
SSDEEP

6144:I2nVKfRwc6AqLKjAZcLraBCDoyAJBRI/K+:B8p1qLMAyraBO/K+

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2900-0-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral2/memory/2900-1-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral2/memory/2900-2-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral2/memory/2900-10-0x0000000000400000-0x000000000048C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 3100	2900	255bed65d1aee27d765ce4492fc9ecd1.exe	90

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2900	255bed65d1aee27d765ce4492fc9ecd1.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 3100	2900	255bed65d1aee27d765ce4492fc9ecd1.exe	90
PID 2900 wrote to memory of 3100	2900	255bed65d1aee27d765ce4492fc9ecd1.exe	90
PID 2900 wrote to memory of 3100	2900	255bed65d1aee27d765ce4492fc9ecd1.exe	90
PID 2900 wrote to memory of 3100	2900	255bed65d1aee27d765ce4492fc9ecd1.exe	90
PID 2900 wrote to memory of 3100	2900	255bed65d1aee27d765ce4492fc9ecd1.exe	90
PID 2900 wrote to memory of 3100	2900	255bed65d1aee27d765ce4492fc9ecd1.exe	90
PID 2900 wrote to memory of 3100	2900	255bed65d1aee27d765ce4492fc9ecd1.exe	90
PID 3100 wrote to memory of 3500	3100	255bed65d1aee27d765ce4492fc9ecd1.exe	38
PID 3100 wrote to memory of 3500	3100	255bed65d1aee27d765ce4492fc9ecd1.exe	38
PID 3100 wrote to memory of 3500	3100	255bed65d1aee27d765ce4492fc9ecd1.exe	38
PID 3100 wrote to memory of 3500	3100	255bed65d1aee27d765ce4492fc9ecd1.exe	38

memory/2900-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2900-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2900-2-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2900-10-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3100-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3100-8-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3100-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3100-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3100-11-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3100-18-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3100-17-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3100-16-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/3500-12-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3500-13-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download