e5463c2718ef830be76d03c08dd761000cbd5e9a468459a4c28180344dd490e8

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 09:30

Target

7cc4c539e8349ae66aaa1c85d99f1e5b.exe
Size

49KB
MD5

7cc4c539e8349ae66aaa1c85d99f1e5b
SHA1

2f31544f13d823c3200cd03470839c56cc905453
SHA256

e5463c2718ef830be76d03c08dd761000cbd5e9a468459a4c28180344dd490e8
SHA512

3b2c5f977bb4f14f25e00faf10479ee9bbc367af6c76315f1631565ae86007e64e083444a979fd2feebd2c03a72d2058b5abf936c1213f2b155a0a011fb2396f
SSDEEP

1536:EaNKNWLW9Vzyd0ttjJV7AI9qOdc2eSKJg:hLW9VmeaIQNg

Score

7^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2504-0-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/2872-7-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/memory/2504-5-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/2872-9-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/memory/2872-3-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/memory/2872-13-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2504 set thread context of 2872	2504	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2504	7cc4c539e8349ae66aaa1c85d99f1e5b.exe
2872	7cc4c539e8349ae66aaa1c85d99f1e5b.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2872	2504	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	28
PID 2504 wrote to memory of 2872	2504	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	28
PID 2504 wrote to memory of 2872	2504	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	28
PID 2504 wrote to memory of 2872	2504	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	28
PID 2504 wrote to memory of 2872	2504	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	28
PID 2504 wrote to memory of 2872	2504	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	28
PID 2504 wrote to memory of 2872	2504	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	28
PID 2504 wrote to memory of 2872	2504	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	28
PID 2504 wrote to memory of 2872	2504	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	28

C:\Users\Admin\AppData\Local\Temp\7cc4c539e8349ae66aaa1c85d99f1e5b.exe
"C:\Users\Admin\AppData\Local\Temp\7cc4c539e8349ae66aaa1c85d99f1e5b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\7cc4c539e8349ae66aaa1c85d99f1e5b.exe
  "C:\Users\Admin\AppData\Local\Temp\7cc4c539e8349ae66aaa1c85d99f1e5b.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2872

memory/2504-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2504-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2872-7-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2872-9-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2872-3-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2872-13-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download