786464ec65a558620e904affae2074653d16c956f69dcd020b780753dc84fd5d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 22:18

Target

b5cb94f0a8bfccd6bc3085b156727176.exe
Size

84KB
MD5

b5cb94f0a8bfccd6bc3085b156727176
SHA1

fb0c05e958a5ce7188201c8e2e09f55dce4ae88d
SHA256

786464ec65a558620e904affae2074653d16c956f69dcd020b780753dc84fd5d
SHA512

bd4d46b59a6ae837afd2c197d4c80e1569899081d659be869d8818adcfc64d8fccc7b1be64556d5268b1c6d5cbf06fa0ced3de85c229c0bf090fbadfd107ae50
SSDEEP

1536:JRGLgRGYv4OGfgrA3iiRHRbIE0VoVbqYN3xCzZQglj:JygWf7x0JWVrNha

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2900-0-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/2900-1-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 4960	2900	b5cb94f0a8bfccd6bc3085b156727176.exe	92

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 4960	2900	b5cb94f0a8bfccd6bc3085b156727176.exe	92
PID 2900 wrote to memory of 4960	2900	b5cb94f0a8bfccd6bc3085b156727176.exe	92
PID 2900 wrote to memory of 4960	2900	b5cb94f0a8bfccd6bc3085b156727176.exe	92
PID 2900 wrote to memory of 4960	2900	b5cb94f0a8bfccd6bc3085b156727176.exe	92
PID 2900 wrote to memory of 4960	2900	b5cb94f0a8bfccd6bc3085b156727176.exe	92

C:\Users\Admin\AppData\Local\Temp\b5cb94f0a8bfccd6bc3085b156727176.exe
"C:\Users\Admin\AppData\Local\Temp\b5cb94f0a8bfccd6bc3085b156727176.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\b5cb94f0a8bfccd6bc3085b156727176.exe
  "C:\Users\Admin\AppData\Local\Temp\b5cb94f0a8bfccd6bc3085b156727176.exe"
  2⤵
  PID:4960

memory/2900-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2900-1-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4960-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4960-3-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4960-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download