94a6680babe173cb68a82115c06cab62c6e30f03d15343b7c3e83eeb7f8a9961

Analysis

max time kernel
129s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 03:56

Target

8e2820fec7620c4095d6aa301560dcca.exe
Size

60KB
MD5

8e2820fec7620c4095d6aa301560dcca
SHA1

eae9b999ef805df9bfe34e54bdae39a78b8e22ec
SHA256

94a6680babe173cb68a82115c06cab62c6e30f03d15343b7c3e83eeb7f8a9961
SHA512

5029fbe05e909e0e1524c4f29af8b00656b4e425fb0ccbd372fabc8c7998344b62258d846e0ba77259f0804d6e170cb9f28f2e1a9aab591b09e1e48a03ca8f34
SSDEEP

1536:f1Rk3oSKCgYCfQSKRmJZ2SpvO1+1qr5GG3tFAIO:9R4oSUYCoSMm32S1CDdEIO

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2116-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/2116-8-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2116 set thread context of 884	2116	8e2820fec7620c4095d6aa301560dcca.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2116	8e2820fec7620c4095d6aa301560dcca.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 884	2116	8e2820fec7620c4095d6aa301560dcca.exe	84
PID 2116 wrote to memory of 884	2116	8e2820fec7620c4095d6aa301560dcca.exe	84
PID 2116 wrote to memory of 884	2116	8e2820fec7620c4095d6aa301560dcca.exe	84
PID 2116 wrote to memory of 884	2116	8e2820fec7620c4095d6aa301560dcca.exe	84
PID 2116 wrote to memory of 884	2116	8e2820fec7620c4095d6aa301560dcca.exe	84
PID 2116 wrote to memory of 884	2116	8e2820fec7620c4095d6aa301560dcca.exe	84
PID 2116 wrote to memory of 884	2116	8e2820fec7620c4095d6aa301560dcca.exe	84
PID 884 wrote to memory of 3444	884	8e2820fec7620c4095d6aa301560dcca.exe	41
PID 884 wrote to memory of 3444	884	8e2820fec7620c4095d6aa301560dcca.exe	41
PID 884 wrote to memory of 3444	884	8e2820fec7620c4095d6aa301560dcca.exe	41
PID 884 wrote to memory of 3444	884	8e2820fec7620c4095d6aa301560dcca.exe	41

memory/884-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/884-4-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/884-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/884-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/884-9-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/884-14-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/884-15-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/884-16-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2116-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2116-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3444-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3444-11-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download