38e9c452b818059076d8ba5cb595b1afb54c0eba3e7c7f1db7f80588eeb14822

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 09:58

Target

b723d01df8e7293c557ab07a2b16f851.exe
Size

177KB
MD5

b723d01df8e7293c557ab07a2b16f851
SHA1

b71d95f471b286eeeecae38dbb812b04f1f416b3
SHA256

38e9c452b818059076d8ba5cb595b1afb54c0eba3e7c7f1db7f80588eeb14822
SHA512

348661f06f424d14c169bcd65f0dbed5d2f35c086398951636bb3ced6b9a6f0a3f4caa8ad4af64cf0051c6eef36716f5feb0d597e841afd84312794f7e48688d
SSDEEP

3072:R/CHLi8gWHQjPoOWuYo5dHTHQlOSPBxpieCNpr/DjEbkOCjr6p92ZfYFxb5Rq7/G:93QHQ0O5Yo5lTwl7P0eCbrbYMEsZwdYC

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4832-0-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4832-7-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4832 set thread context of 3624	4832	b723d01df8e7293c557ab07a2b16f851.exe	95

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4832	b723d01df8e7293c557ab07a2b16f851.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3624	4832	b723d01df8e7293c557ab07a2b16f851.exe	95
PID 4832 wrote to memory of 3624	4832	b723d01df8e7293c557ab07a2b16f851.exe	95
PID 4832 wrote to memory of 3624	4832	b723d01df8e7293c557ab07a2b16f851.exe	95
PID 4832 wrote to memory of 3624	4832	b723d01df8e7293c557ab07a2b16f851.exe	95
PID 4832 wrote to memory of 3624	4832	b723d01df8e7293c557ab07a2b16f851.exe	95
PID 4832 wrote to memory of 3624	4832	b723d01df8e7293c557ab07a2b16f851.exe	95
PID 4832 wrote to memory of 3624	4832	b723d01df8e7293c557ab07a2b16f851.exe	95
PID 4832 wrote to memory of 3624	4832	b723d01df8e7293c557ab07a2b16f851.exe	95
PID 4832 wrote to memory of 3624	4832	b723d01df8e7293c557ab07a2b16f851.exe	95
PID 3624 wrote to memory of 3316	3624	b723d01df8e7293c557ab07a2b16f851.exe	56
PID 3624 wrote to memory of 3316	3624	b723d01df8e7293c557ab07a2b16f851.exe	56
PID 3624 wrote to memory of 3316	3624	b723d01df8e7293c557ab07a2b16f851.exe	56
PID 3624 wrote to memory of 3316	3624	b723d01df8e7293c557ab07a2b16f851.exe	56

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1304 --field-trial-handle=2256,i,18272763564106695635,11201593968620719822,262144 --variations-seed-version /prefetch:8
1⤵
PID:2776

memory/3316-11-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3316-12-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3624-3-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3624-5-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3624-6-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3624-8-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3624-9-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3624-15-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/3624-16-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3624-17-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4832-0-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4832-7-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download