d00195929cea3748192943d6a0aa62edd7b65277a1e0af3eb5b3b02c34d2b511

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 04:00

Target

986c4f7fbfdfc2ff6912041c03e06869.exe
Size

129KB
MD5

986c4f7fbfdfc2ff6912041c03e06869
SHA1

755224f4defaaed1f45c07d6bfdacf05558f545d
SHA256

d00195929cea3748192943d6a0aa62edd7b65277a1e0af3eb5b3b02c34d2b511
SHA512

360ce18541b6a7ae1d849e4c12c625ce4aff11e0fcc64432d8f3062b3841d8a934d63039febf8a063cc1bb67e7bd82526517bf071ab89f989a03677e00f5a591
SSDEEP

3072:IHNiOCNgOq3w8J+iuMbbOaXfv0k9nb3jSuHCOS2MIz5v:ItINg+9iuMPJJ3jSCCOSBIh

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1740-0-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/1740-7-0x0000000000400000-0x000000000044D000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1740 set thread context of 2892	1740	986c4f7fbfdfc2ff6912041c03e06869.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2892	986c4f7fbfdfc2ff6912041c03e06869.exe
2892	986c4f7fbfdfc2ff6912041c03e06869.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1740	986c4f7fbfdfc2ff6912041c03e06869.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2892	1740	986c4f7fbfdfc2ff6912041c03e06869.exe	28
PID 1740 wrote to memory of 2892	1740	986c4f7fbfdfc2ff6912041c03e06869.exe	28
PID 1740 wrote to memory of 2892	1740	986c4f7fbfdfc2ff6912041c03e06869.exe	28
PID 1740 wrote to memory of 2892	1740	986c4f7fbfdfc2ff6912041c03e06869.exe	28
PID 1740 wrote to memory of 2892	1740	986c4f7fbfdfc2ff6912041c03e06869.exe	28
PID 1740 wrote to memory of 2892	1740	986c4f7fbfdfc2ff6912041c03e06869.exe	28
PID 1740 wrote to memory of 2892	1740	986c4f7fbfdfc2ff6912041c03e06869.exe	28
PID 1740 wrote to memory of 2892	1740	986c4f7fbfdfc2ff6912041c03e06869.exe	28
PID 2892 wrote to memory of 1196	2892	986c4f7fbfdfc2ff6912041c03e06869.exe	11
PID 2892 wrote to memory of 1196	2892	986c4f7fbfdfc2ff6912041c03e06869.exe	11
PID 2892 wrote to memory of 1196	2892	986c4f7fbfdfc2ff6912041c03e06869.exe	11
PID 2892 wrote to memory of 1196	2892	986c4f7fbfdfc2ff6912041c03e06869.exe	11

memory/1196-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1196-13-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1740-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1740-7-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2892-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2892-5-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2892-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2892-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2892-9-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2892-22-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2892-23-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download