f21e0925f5dcc5e565ed78b69c9e6effe8fcd520fcbb0374bf5a799443bf5ea4

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 16:36

Target

9c26d17dced57fad44710164f71d36f9.exe
Size

830KB
MD5

9c26d17dced57fad44710164f71d36f9
SHA1

535360605e71f00695cde1bf6ae9f15cc0d33ab3
SHA256

f21e0925f5dcc5e565ed78b69c9e6effe8fcd520fcbb0374bf5a799443bf5ea4
SHA512

aa4a1b256a6bf4e604aa0ea0815e93c7b914faaf6d4afd2fb5a32911cdeb6b27e38b54b6e4bebdab456ebb98d91274675dcfb1d00f286c043f5f9fda5c866d25
SSDEEP

12288:oEaFentQvrkxX9189R/qlc8RI7YZuBJ919WS+exraoHm++SQgbKCa26z2yz3VLyI:oZen6AxXwR/qlc7l96Kr7mbSQiKsylt

Score

7^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1884-0-0x0000000000400000-0x00000000007A5000-memory.dmp	upx
behavioral2/memory/1068-3-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/1068-5-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/1068-7-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/1884-8-0x0000000000400000-0x00000000007A5000-memory.dmp	upx
behavioral2/memory/1068-12-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1884 set thread context of 1068	1884	9c26d17dced57fad44710164f71d36f9.exe	84

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1884	9c26d17dced57fad44710164f71d36f9.exe
1068	9c26d17dced57fad44710164f71d36f9.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1068	1884	9c26d17dced57fad44710164f71d36f9.exe	84
PID 1884 wrote to memory of 1068	1884	9c26d17dced57fad44710164f71d36f9.exe	84
PID 1884 wrote to memory of 1068	1884	9c26d17dced57fad44710164f71d36f9.exe	84
PID 1884 wrote to memory of 1068	1884	9c26d17dced57fad44710164f71d36f9.exe	84
PID 1884 wrote to memory of 1068	1884	9c26d17dced57fad44710164f71d36f9.exe	84
PID 1884 wrote to memory of 1068	1884	9c26d17dced57fad44710164f71d36f9.exe	84
PID 1884 wrote to memory of 1068	1884	9c26d17dced57fad44710164f71d36f9.exe	84
PID 1884 wrote to memory of 1068	1884	9c26d17dced57fad44710164f71d36f9.exe	84

C:\Users\Admin\AppData\Local\Temp\9c26d17dced57fad44710164f71d36f9.exe
"C:\Users\Admin\AppData\Local\Temp\9c26d17dced57fad44710164f71d36f9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\9c26d17dced57fad44710164f71d36f9.exe
  "C:\Users\Admin\AppData\Local\Temp\9c26d17dced57fad44710164f71d36f9.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1068

memory/1068-3-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1068-5-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1068-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1068-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1884-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/1884-8-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download