5d401d980b1e09a86afc8d02f405ee598c7fea5dad7e785d4400f6ab2b9714ae

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 06:20

Target

5d401d980b1e09a86afc8d02f405ee598c7fea5dad7e785d4400f6ab2b9714ae.exe
Size

1.1MB
MD5

043e82f37aa8f256b66cbec804d906c6
SHA1

d3c211574745659ca6476f616bb2071a97566386
SHA256

5d401d980b1e09a86afc8d02f405ee598c7fea5dad7e785d4400f6ab2b9714ae
SHA512

1c8fc121b441d85c1ef2a4af967a7459a5a9bb717a9e89eeeada72e1b47072f49189501103466d81d70e970b54e8ebc80fa385aba2bc512c9c5a2c4e25d35c25
SSDEEP

24576:bddP2RScRLbk4m3A4zxDow+aTSM3h75UrdRhtVtptd/gtTBNogN7A/mr:bddP2RSl4m3Tz973h7Kht9gtTx7r

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3268-1-0x00007FF6F02A0000-0x00007FF6F0461000-memory.dmp	upx
behavioral2/memory/3268-0-0x00007FF6F02A0000-0x00007FF6F0461000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3268	5d401d980b1e09a86afc8d02f405ee598c7fea5dad7e785d4400f6ab2b9714ae.exe

C:\Users\Admin\AppData\Local\Temp\5d401d980b1e09a86afc8d02f405ee598c7fea5dad7e785d4400f6ab2b9714ae.exe
"C:\Users\Admin\AppData\Local\Temp\5d401d980b1e09a86afc8d02f405ee598c7fea5dad7e785d4400f6ab2b9714ae.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3268

memory/3268-1-0x00007FF6F02A0000-0x00007FF6F0461000-memory.dmp

Filesize
1.8MB

Download
memory/3268-0-0x00007FF6F02A0000-0x00007FF6F0461000-memory.dmp

Filesize
1.8MB

Download