e5463c2718ef830be76d03c08dd761000cbd5e9a468459a4c28180344dd490e8

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 09:30

Target

7cc4c539e8349ae66aaa1c85d99f1e5b.exe
Size

49KB
MD5

7cc4c539e8349ae66aaa1c85d99f1e5b
SHA1

2f31544f13d823c3200cd03470839c56cc905453
SHA256

e5463c2718ef830be76d03c08dd761000cbd5e9a468459a4c28180344dd490e8
SHA512

3b2c5f977bb4f14f25e00faf10479ee9bbc367af6c76315f1631565ae86007e64e083444a979fd2feebd2c03a72d2058b5abf936c1213f2b155a0a011fb2396f
SSDEEP

1536:EaNKNWLW9Vzyd0ttjJV7AI9qOdc2eSKJg:hLW9VmeaIQNg

Score

7^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1344-0-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral2/memory/4540-3-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/4540-5-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/4540-7-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/1344-6-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral2/memory/4540-11-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1344 set thread context of 4540	1344	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	88

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1344	7cc4c539e8349ae66aaa1c85d99f1e5b.exe
4540	7cc4c539e8349ae66aaa1c85d99f1e5b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 4540	1344	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	88
PID 1344 wrote to memory of 4540	1344	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	88
PID 1344 wrote to memory of 4540	1344	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	88
PID 1344 wrote to memory of 4540	1344	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	88
PID 1344 wrote to memory of 4540	1344	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	88
PID 1344 wrote to memory of 4540	1344	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	88
PID 1344 wrote to memory of 4540	1344	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	88
PID 1344 wrote to memory of 4540	1344	7cc4c539e8349ae66aaa1c85d99f1e5b.exe	88

C:\Users\Admin\AppData\Local\Temp\7cc4c539e8349ae66aaa1c85d99f1e5b.exe
"C:\Users\Admin\AppData\Local\Temp\7cc4c539e8349ae66aaa1c85d99f1e5b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Local\Temp\7cc4c539e8349ae66aaa1c85d99f1e5b.exe
  "C:\Users\Admin\AppData\Local\Temp\7cc4c539e8349ae66aaa1c85d99f1e5b.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4540

memory/1344-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1344-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4540-3-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4540-5-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4540-7-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4540-11-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download