77e7c129511113ee263d5901073f09f33afc036955d702ca275d13582c75420a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 07:06

Target

8e858821873edaf3f735fcb73f8ef49b.exe
Size

10KB
MD5

8e858821873edaf3f735fcb73f8ef49b
SHA1

30359e83b24edf718fcca96a74f2bb03edf48362
SHA256

77e7c129511113ee263d5901073f09f33afc036955d702ca275d13582c75420a
SHA512

27183e837122d08441a0cd41d7c63e1b4deec6911483ca661a12721f5b37fd5f2dea2b16141291535bfd535e65308146d2774da3e7db7025677ac03bd569ae1e
SSDEEP

192:qtveI8IAouwZuXqZpjpSE/Po5S+ZPOj7eBQEW:qtvehqZpjpbno5SuOj7eBbW

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2616	cmd.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2072-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2072-5-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2072-6-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2072-17-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2072	8e858821873edaf3f735fcb73f8ef49b.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2616	2072	8e858821873edaf3f735fcb73f8ef49b.exe	30
PID 2072 wrote to memory of 2616	2072	8e858821873edaf3f735fcb73f8ef49b.exe	30
PID 2072 wrote to memory of 2616	2072	8e858821873edaf3f735fcb73f8ef49b.exe	30
PID 2072 wrote to memory of 2616	2072	8e858821873edaf3f735fcb73f8ef49b.exe	30
PID 2072 wrote to memory of 2616	2072	8e858821873edaf3f735fcb73f8ef49b.exe	30
PID 2072 wrote to memory of 2616	2072	8e858821873edaf3f735fcb73f8ef49b.exe	30
PID 2072 wrote to memory of 2616	2072	8e858821873edaf3f735fcb73f8ef49b.exe	30

C:\Users\Admin\AppData\Local\Temp\8e858821873edaf3f735fcb73f8ef49b.exe
"C:\Users\Admin\AppData\Local\Temp\8e858821873edaf3f735fcb73f8ef49b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""killme.bat""
  2⤵
  - Deletes itself
  PID:2616

C:\Users\Admin\AppData\Local\Temp\killme.bat

Filesize
130B

MD5
bbd08e42d593f7761d6cfbed23536312

SHA1
faeec7c0ca60601dc3242bf10ea9672730650242

SHA256
7c842afe429c0893f996c06e1aad5e36515526876142a46c3f65c744b7425b4d

SHA512
10a8c23c9ef12071413b74d37c1ce43a12715d05472b284b875de8d2cf458168ca82f92fa1d7904c96ca97f0989da6cc190ac82d9eed7b19082c5386464739bb

Download Submit
memory/2072-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2072-1-0x0000000000020000-0x000000000002A000-memory.dmp

Filesize
40KB

Download
memory/2072-2-0x0000000000020000-0x000000000002A000-memory.dmp

Filesize
40KB

Download
memory/2072-5-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2072-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2072-7-0x0000000000020000-0x000000000002A000-memory.dmp

Filesize
40KB

Download
memory/2072-8-0x0000000000020000-0x000000000002A000-memory.dmp

Filesize
40KB

Download
memory/2072-17-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download