0cb74d1ad7baae604d4815596c27ffc9f355d3e0b7e7d75dde0b8664da348810

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 05:46

Target

8b8c91d7a6eba22e131967868b4fe2e8.exe
Size

1.1MB
MD5

8b8c91d7a6eba22e131967868b4fe2e8
SHA1

3a7ee8b7985ad6d680cebf67e7d02a2578d710c4
SHA256

0cb74d1ad7baae604d4815596c27ffc9f355d3e0b7e7d75dde0b8664da348810
SHA512

8d8c1862efe79ca02f843b20b2810073ede8d50a5dd37146bce0af081a53ac809d78427aee21e4c7081d225f5ea6759362f773d86fa96edf406eb73f0d41f93b
SSDEEP

6144:+DNovLTeiQSgYRdPAGgpM+hmKZajuMF40f+q2Wcycd5MTialDxK+rdP9:FvLB1RYecyi8BlD

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2728-3-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/2728-5-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/2728-7-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/2728-14-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 2728	1732	8b8c91d7a6eba22e131967868b4fe2e8.exe	86
PID 2728 set thread context of 2216	2728	8b8c91d7a6eba22e131967868b4fe2e8.exe	88

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1732	8b8c91d7a6eba22e131967868b4fe2e8.exe
2728	8b8c91d7a6eba22e131967868b4fe2e8.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2728	1732	8b8c91d7a6eba22e131967868b4fe2e8.exe	86
PID 1732 wrote to memory of 2728	1732	8b8c91d7a6eba22e131967868b4fe2e8.exe	86
PID 1732 wrote to memory of 2728	1732	8b8c91d7a6eba22e131967868b4fe2e8.exe	86
PID 1732 wrote to memory of 2728	1732	8b8c91d7a6eba22e131967868b4fe2e8.exe	86
PID 1732 wrote to memory of 2728	1732	8b8c91d7a6eba22e131967868b4fe2e8.exe	86
PID 1732 wrote to memory of 2728	1732	8b8c91d7a6eba22e131967868b4fe2e8.exe	86
PID 1732 wrote to memory of 2728	1732	8b8c91d7a6eba22e131967868b4fe2e8.exe	86
PID 1732 wrote to memory of 2728	1732	8b8c91d7a6eba22e131967868b4fe2e8.exe	86
PID 2728 wrote to memory of 2216	2728	8b8c91d7a6eba22e131967868b4fe2e8.exe	88
PID 2728 wrote to memory of 2216	2728	8b8c91d7a6eba22e131967868b4fe2e8.exe	88
PID 2728 wrote to memory of 2216	2728	8b8c91d7a6eba22e131967868b4fe2e8.exe	88
PID 2728 wrote to memory of 2216	2728	8b8c91d7a6eba22e131967868b4fe2e8.exe	88
PID 2728 wrote to memory of 2216	2728	8b8c91d7a6eba22e131967868b4fe2e8.exe	88
PID 2728 wrote to memory of 2216	2728	8b8c91d7a6eba22e131967868b4fe2e8.exe	88
PID 2728 wrote to memory of 2216	2728	8b8c91d7a6eba22e131967868b4fe2e8.exe	88

memory/1732-0-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/1732-6-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/2216-11-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2216-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-17-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2216-19-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2728-3-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2728-5-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2728-7-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2728-14-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download