73031d153d8dc0eff7c62138ca824c9b3138b473f87f73e641a30cffe4d92c57

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 17:36

Target

7adac8ea5960acac82bf79d475c59a6b.exe
Size

182KB
MD5

7adac8ea5960acac82bf79d475c59a6b
SHA1

77c63d05142b3a1cdd687f85f4346fe0cae223fb
SHA256

73031d153d8dc0eff7c62138ca824c9b3138b473f87f73e641a30cffe4d92c57
SHA512

0194ef426ea03cb6156200a6e32d72fe349399fb6a02062368a3060eb4bc5d4132fe3ad65b85c9170e1d6539b9b477c38671fa20d18c64d32b6ce83f7cf74d77
SSDEEP

3072:pFHkYYrfjxtk3s/XH7s1p76NytEe09DBrh4bqVk2ujkrMO+t/WZ:pFHkBrnk3sC7fEemb4Mk2XM9W

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2944-0-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2944-7-0x0000000000400000-0x0000000000498000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\autorun.ico	7adac8ea5960acac82bf79d475c59a6b.exe
File created	C:\Windows\SysWOW64\vmmreg32.dll	7adac8ea5960acac82bf79d475c59a6b.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2944 set thread context of 1892	2944	7adac8ea5960acac82bf79d475c59a6b.exe	28
PID 2944 set thread context of 0	2944	7adac8ea5960acac82bf79d475c59a6b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2944	7adac8ea5960acac82bf79d475c59a6b.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1892	2944	7adac8ea5960acac82bf79d475c59a6b.exe	28
PID 2944 wrote to memory of 1892	2944	7adac8ea5960acac82bf79d475c59a6b.exe	28
PID 2944 wrote to memory of 1892	2944	7adac8ea5960acac82bf79d475c59a6b.exe	28
PID 2944 wrote to memory of 1892	2944	7adac8ea5960acac82bf79d475c59a6b.exe	28
PID 2944 wrote to memory of 1892	2944	7adac8ea5960acac82bf79d475c59a6b.exe	28
PID 2944 wrote to memory of 1892	2944	7adac8ea5960acac82bf79d475c59a6b.exe	28
PID 2944 wrote to memory of 1892	2944	7adac8ea5960acac82bf79d475c59a6b.exe	28
PID 2944 wrote to memory of 1892	2944	7adac8ea5960acac82bf79d475c59a6b.exe	28
PID 2944 wrote to memory of 0	2944	7adac8ea5960acac82bf79d475c59a6b.exe
PID 2944 wrote to memory of 0	2944	7adac8ea5960acac82bf79d475c59a6b.exe
PID 2944 wrote to memory of 0	2944	7adac8ea5960acac82bf79d475c59a6b.exe
PID 2944 wrote to memory of 0	2944	7adac8ea5960acac82bf79d475c59a6b.exe

C:\Users\Admin\AppData\Local\Temp\7adac8ea5960acac82bf79d475c59a6b.exe
"C:\Users\Admin\AppData\Local\Temp\7adac8ea5960acac82bf79d475c59a6b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\7adac8ea5960acac82bf79d475c59a6b.exe
  "C:\Users\Admin\AppData\Local\Temp\7adac8ea5960acac82bf79d475c59a6b.exe"
  2⤵
  PID:1892

memory/1892-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1892-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1892-8-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1892-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1892-11-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1892-12-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2944-0-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2944-7-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download