b65356ffe2480c8aa5464748cec3b19cda085ad7b7ce0fddb07b2b19b4537052

Analysis

max time kernel
93s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 08:07

Target

ab69674a7c5c632c6ab831e6b5fff7cc.exe
Size

248KB
MD5

ab69674a7c5c632c6ab831e6b5fff7cc
SHA1

3e6e626f620428e84978693c25f41514769c2709
SHA256

b65356ffe2480c8aa5464748cec3b19cda085ad7b7ce0fddb07b2b19b4537052
SHA512

a6b7bd74f84a9f6df136a46b48b006eb5895ddc6fc72f6b8cf17b069135baf1eab9a75a3c2789a4bdc5fec8843f776378f32ee5272c21bca3e484334b190af11
SSDEEP

6144:vQ9cTb5exHySnX1lzQ5/VLsOUshdIRMypR1HDqC:vBTbaLn7M5/ukVshWC

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2240-3-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/2240-5-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/2240-7-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/2240-16-0x0000000000400000-0x0000000000427000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1184 set thread context of 2240	1184	ab69674a7c5c632c6ab831e6b5fff7cc.exe	90
PID 2240 set thread context of 3668	2240	ab69674a7c5c632c6ab831e6b5fff7cc.exe	91

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1184	ab69674a7c5c632c6ab831e6b5fff7cc.exe
2240	ab69674a7c5c632c6ab831e6b5fff7cc.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2240	1184	ab69674a7c5c632c6ab831e6b5fff7cc.exe	90
PID 1184 wrote to memory of 2240	1184	ab69674a7c5c632c6ab831e6b5fff7cc.exe	90
PID 1184 wrote to memory of 2240	1184	ab69674a7c5c632c6ab831e6b5fff7cc.exe	90
PID 1184 wrote to memory of 2240	1184	ab69674a7c5c632c6ab831e6b5fff7cc.exe	90
PID 1184 wrote to memory of 2240	1184	ab69674a7c5c632c6ab831e6b5fff7cc.exe	90
PID 1184 wrote to memory of 2240	1184	ab69674a7c5c632c6ab831e6b5fff7cc.exe	90
PID 1184 wrote to memory of 2240	1184	ab69674a7c5c632c6ab831e6b5fff7cc.exe	90
PID 1184 wrote to memory of 2240	1184	ab69674a7c5c632c6ab831e6b5fff7cc.exe	90
PID 2240 wrote to memory of 3668	2240	ab69674a7c5c632c6ab831e6b5fff7cc.exe	91
PID 2240 wrote to memory of 3668	2240	ab69674a7c5c632c6ab831e6b5fff7cc.exe	91
PID 2240 wrote to memory of 3668	2240	ab69674a7c5c632c6ab831e6b5fff7cc.exe	91
PID 2240 wrote to memory of 3668	2240	ab69674a7c5c632c6ab831e6b5fff7cc.exe	91
PID 2240 wrote to memory of 3668	2240	ab69674a7c5c632c6ab831e6b5fff7cc.exe	91
PID 2240 wrote to memory of 3668	2240	ab69674a7c5c632c6ab831e6b5fff7cc.exe	91
PID 2240 wrote to memory of 3668	2240	ab69674a7c5c632c6ab831e6b5fff7cc.exe	91
PID 3668 wrote to memory of 3384	3668	ab69674a7c5c632c6ab831e6b5fff7cc.exe	49
PID 3668 wrote to memory of 3384	3668	ab69674a7c5c632c6ab831e6b5fff7cc.exe	49
PID 3668 wrote to memory of 3384	3668	ab69674a7c5c632c6ab831e6b5fff7cc.exe	49
PID 3668 wrote to memory of 3384	3668	ab69674a7c5c632c6ab831e6b5fff7cc.exe	49

memory/1184-8-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1184-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2240-3-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2240-5-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2240-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2240-14-0x0000000000430000-0x00000000004F9000-memory.dmp

Filesize
804KB

Download
memory/2240-16-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3384-19-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3384-20-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3668-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3668-15-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/3668-18-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/3668-17-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3668-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3668-25-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download