38e9c452b818059076d8ba5cb595b1afb54c0eba3e7c7f1db7f80588eeb14822

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 09:58

Target

b723d01df8e7293c557ab07a2b16f851.exe
Size

177KB
MD5

b723d01df8e7293c557ab07a2b16f851
SHA1

b71d95f471b286eeeecae38dbb812b04f1f416b3
SHA256

38e9c452b818059076d8ba5cb595b1afb54c0eba3e7c7f1db7f80588eeb14822
SHA512

348661f06f424d14c169bcd65f0dbed5d2f35c086398951636bb3ced6b9a6f0a3f4caa8ad4af64cf0051c6eef36716f5feb0d597e841afd84312794f7e48688d
SSDEEP

3072:R/CHLi8gWHQjPoOWuYo5dHTHQlOSPBxpieCNpr/DjEbkOCjr6p92ZfYFxb5Rq7/G:93QHQ0O5Yo5lTwl7P0eCbrbYMEsZwdYC

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2308-0-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/2308-6-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2308 set thread context of 2168	2308	b723d01df8e7293c557ab07a2b16f851.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2168	b723d01df8e7293c557ab07a2b16f851.exe
2168	b723d01df8e7293c557ab07a2b16f851.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2308	b723d01df8e7293c557ab07a2b16f851.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2168	2308	b723d01df8e7293c557ab07a2b16f851.exe	28
PID 2308 wrote to memory of 2168	2308	b723d01df8e7293c557ab07a2b16f851.exe	28
PID 2308 wrote to memory of 2168	2308	b723d01df8e7293c557ab07a2b16f851.exe	28
PID 2308 wrote to memory of 2168	2308	b723d01df8e7293c557ab07a2b16f851.exe	28
PID 2308 wrote to memory of 2168	2308	b723d01df8e7293c557ab07a2b16f851.exe	28
PID 2308 wrote to memory of 2168	2308	b723d01df8e7293c557ab07a2b16f851.exe	28
PID 2308 wrote to memory of 2168	2308	b723d01df8e7293c557ab07a2b16f851.exe	28
PID 2308 wrote to memory of 2168	2308	b723d01df8e7293c557ab07a2b16f851.exe	28
PID 2308 wrote to memory of 2168	2308	b723d01df8e7293c557ab07a2b16f851.exe	28
PID 2308 wrote to memory of 2168	2308	b723d01df8e7293c557ab07a2b16f851.exe	28
PID 2168 wrote to memory of 1396	2168	b723d01df8e7293c557ab07a2b16f851.exe	21
PID 2168 wrote to memory of 1396	2168	b723d01df8e7293c557ab07a2b16f851.exe	21
PID 2168 wrote to memory of 1396	2168	b723d01df8e7293c557ab07a2b16f851.exe	21
PID 2168 wrote to memory of 1396	2168	b723d01df8e7293c557ab07a2b16f851.exe	21

memory/1396-11-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1396-14-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2168-3-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2168-5-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2168-7-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2168-8-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2168-9-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2168-23-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2168-24-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2308-0-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2308-6-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download