157de59a73f4be67b239c54646035f2acaa490c2ef1df09f4b80db3f3775ec0a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:59

Target

370c1c4b1ae59febe04a0e1af4ee0fb5.exe
Size

375KB
MD5

370c1c4b1ae59febe04a0e1af4ee0fb5
SHA1

b3fd865a79f13bda5589c92eef7aae38311e2905
SHA256

157de59a73f4be67b239c54646035f2acaa490c2ef1df09f4b80db3f3775ec0a
SHA512

b1316fec89c71cbaf58db1626bb197132ad2615272e3e7573702b4b57e432346feb83c7c4e04bf0ed7df4bd7ff27c34c22237138565b0ca3f8cbf106971474af
SSDEEP

6144:har413Vt2TSpoYsjBXsgzm3OBfesrQ0XhYoqRaAz54Kj6NFX:hEGt9poYsjB80me0srQehYlagvQ

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2988-0-0x0000000000400000-0x00000000005B9000-memory.dmp	upx
behavioral1/memory/2988-18-0x0000000000400000-0x00000000005B9000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2988 set thread context of 2188	2988	370c1c4b1ae59febe04a0e1af4ee0fb5.exe	21

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2188	370c1c4b1ae59febe04a0e1af4ee0fb5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	370c1c4b1ae59febe04a0e1af4ee0fb5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2988	370c1c4b1ae59febe04a0e1af4ee0fb5.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2188	2988	370c1c4b1ae59febe04a0e1af4ee0fb5.exe	21
PID 2988 wrote to memory of 2188	2988	370c1c4b1ae59febe04a0e1af4ee0fb5.exe	21
PID 2988 wrote to memory of 2188	2988	370c1c4b1ae59febe04a0e1af4ee0fb5.exe	21
PID 2988 wrote to memory of 2188	2988	370c1c4b1ae59febe04a0e1af4ee0fb5.exe	21
PID 2988 wrote to memory of 2188	2988	370c1c4b1ae59febe04a0e1af4ee0fb5.exe	21
PID 2988 wrote to memory of 2188	2988	370c1c4b1ae59febe04a0e1af4ee0fb5.exe	21
PID 2988 wrote to memory of 2188	2988	370c1c4b1ae59febe04a0e1af4ee0fb5.exe	21
PID 2988 wrote to memory of 2188	2988	370c1c4b1ae59febe04a0e1af4ee0fb5.exe	21
PID 2988 wrote to memory of 2188	2988	370c1c4b1ae59febe04a0e1af4ee0fb5.exe	21
PID 2988 wrote to memory of 2188	2988	370c1c4b1ae59febe04a0e1af4ee0fb5.exe	21

memory/2188-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2188-12-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2188-19-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2188-20-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2188-21-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/2188-16-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2188-28-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2188-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2188-25-0x00000000005B0000-0x00000000005FF000-memory.dmp

Filesize
316KB

Download
memory/2188-7-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2188-9-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2188-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2988-0-0x0000000000400000-0x00000000005B9000-memory.dmp

Filesize
1.7MB

Download
memory/2988-10-0x0000000003750000-0x0000000003909000-memory.dmp

Filesize
1.7MB

Download
memory/2988-18-0x0000000000400000-0x00000000005B9000-memory.dmp

Filesize
1.7MB

Download