94a6680babe173cb68a82115c06cab62c6e30f03d15343b7c3e83eeb7f8a9961

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 03:56

Target

8e2820fec7620c4095d6aa301560dcca.exe
Size

60KB
MD5

8e2820fec7620c4095d6aa301560dcca
SHA1

eae9b999ef805df9bfe34e54bdae39a78b8e22ec
SHA256

94a6680babe173cb68a82115c06cab62c6e30f03d15343b7c3e83eeb7f8a9961
SHA512

5029fbe05e909e0e1524c4f29af8b00656b4e425fb0ccbd372fabc8c7998344b62258d846e0ba77259f0804d6e170cb9f28f2e1a9aab591b09e1e48a03ca8f34
SSDEEP

1536:f1Rk3oSKCgYCfQSKRmJZ2SpvO1+1qr5GG3tFAIO:9R4oSUYCoSMm32S1CDdEIO

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1924-1-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1924-8-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1924 set thread context of 1092	1924	8e2820fec7620c4095d6aa301560dcca.exe	16

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1092	8e2820fec7620c4095d6aa301560dcca.exe
1092	8e2820fec7620c4095d6aa301560dcca.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1924	8e2820fec7620c4095d6aa301560dcca.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1092	1924	8e2820fec7620c4095d6aa301560dcca.exe	16
PID 1924 wrote to memory of 1092	1924	8e2820fec7620c4095d6aa301560dcca.exe	16
PID 1924 wrote to memory of 1092	1924	8e2820fec7620c4095d6aa301560dcca.exe	16
PID 1924 wrote to memory of 1092	1924	8e2820fec7620c4095d6aa301560dcca.exe	16
PID 1924 wrote to memory of 1092	1924	8e2820fec7620c4095d6aa301560dcca.exe	16
PID 1924 wrote to memory of 1092	1924	8e2820fec7620c4095d6aa301560dcca.exe	16
PID 1924 wrote to memory of 1092	1924	8e2820fec7620c4095d6aa301560dcca.exe	16
PID 1924 wrote to memory of 1092	1924	8e2820fec7620c4095d6aa301560dcca.exe	16
PID 1092 wrote to memory of 1284	1092	8e2820fec7620c4095d6aa301560dcca.exe	7
PID 1092 wrote to memory of 1284	1092	8e2820fec7620c4095d6aa301560dcca.exe	7
PID 1092 wrote to memory of 1284	1092	8e2820fec7620c4095d6aa301560dcca.exe	7
PID 1092 wrote to memory of 1284	1092	8e2820fec7620c4095d6aa301560dcca.exe	7

memory/1092-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1092-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1092-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1092-6-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1092-13-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1092-24-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1092-23-0x0000000000410000-0x0000000000477000-memory.dmp

Filesize
412KB

Download
memory/1284-14-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1284-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1924-1-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1924-4-0x0000000000230000-0x000000000025E000-memory.dmp

Filesize
184KB

Download
memory/1924-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download