25510d20b983dbfc0443684dd1674192cb32b9ab06a2ab9e67e2db6f99ead154

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 14:46

Target

b4f52848c48aea663e5344e33a1b087a.exe
Size

609KB
MD5

b4f52848c48aea663e5344e33a1b087a
SHA1

952e076be5498fcbb41123070c5a297c329e2395
SHA256

25510d20b983dbfc0443684dd1674192cb32b9ab06a2ab9e67e2db6f99ead154
SHA512

5e78c19e2084ae3c9f90be86e4458ded13cea66f2185bc26637a2b00f8ff57d5d1da09ed99f47b981e59815ef63ee7d10ffb506157b178e95fa56356e8dc997e
SSDEEP

12288:BLcKp2Adls/rnjs7RLKslAmJSv4KMwUU9d8Kb6a:CK2GsD4RLTlzJSv4sGKGa

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2164-0-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral1/memory/2164-5-0x0000000000400000-0x0000000000437000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2164 set thread context of 2080	2164	b4f52848c48aea663e5344e33a1b087a.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	2080	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2164	b4f52848c48aea663e5344e33a1b087a.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2080	2164	b4f52848c48aea663e5344e33a1b087a.exe	28
PID 2164 wrote to memory of 2080	2164	b4f52848c48aea663e5344e33a1b087a.exe	28
PID 2164 wrote to memory of 2080	2164	b4f52848c48aea663e5344e33a1b087a.exe	28
PID 2164 wrote to memory of 2080	2164	b4f52848c48aea663e5344e33a1b087a.exe	28
PID 2164 wrote to memory of 2080	2164	b4f52848c48aea663e5344e33a1b087a.exe	28
PID 2164 wrote to memory of 2080	2164	b4f52848c48aea663e5344e33a1b087a.exe	28
PID 2164 wrote to memory of 2080	2164	b4f52848c48aea663e5344e33a1b087a.exe	28
PID 2164 wrote to memory of 2080	2164	b4f52848c48aea663e5344e33a1b087a.exe	28
PID 2164 wrote to memory of 2080	2164	b4f52848c48aea663e5344e33a1b087a.exe	28
PID 2080 wrote to memory of 2172	2080	b4f52848c48aea663e5344e33a1b087a.exe	29
PID 2080 wrote to memory of 2172	2080	b4f52848c48aea663e5344e33a1b087a.exe	29
PID 2080 wrote to memory of 2172	2080	b4f52848c48aea663e5344e33a1b087a.exe	29
PID 2080 wrote to memory of 2172	2080	b4f52848c48aea663e5344e33a1b087a.exe	29

memory/2080-3-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2080-6-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2080-8-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2080-9-0x00000000001B0000-0x00000000001C3000-memory.dmp

Filesize
76KB

Download
memory/2164-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2164-5-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download