c9d5c2b9d43e4b202cbf66559e5e898381e116344e9fda381bcc320c292d7928

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 11:54

Target

be8b267b465f1a904e802653ee33dec2.exe
Size

214KB
MD5

be8b267b465f1a904e802653ee33dec2
SHA1

23dd62a541260a09cb60ad22a4581d5b6864ff91
SHA256

c9d5c2b9d43e4b202cbf66559e5e898381e116344e9fda381bcc320c292d7928
SHA512

1b0db5f39d9d0276f568490ed5e860c4c45278d5c425d94df66c25baf31cde7a23d0f51f454cab81d9bdd37ef647fef7f0905982c9a833d4264be870b54cb242
SSDEEP

6144:8PLpKtP/45Z9YwXcaieEMGp0rejOglSTMKqLVR3UZU:mAlcYwXDi3Tp0rnPWR3UZU

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4412-0-0x0000000000400000-0x00000000004AC000-memory.dmp	upx
behavioral2/memory/4412-5-0x0000000000400000-0x00000000004AC000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

be8b267b465f1a904e802653ee33dec2.exe

description pid process target process

PID 4412 set thread context of 1532 4412 be8b267b465f1a904e802653ee33dec2.exe be8b267b465f1a904e802653ee33dec2.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

be8b267b465f1a904e802653ee33dec2.exe

pid process

4412 be8b267b465f1a904e802653ee33dec2.exe

description	pid	process	target process
PID 4412 set thread context of 1532	4412	be8b267b465f1a904e802653ee33dec2.exe	be8b267b465f1a904e802653ee33dec2.exe

pid	process
4412	be8b267b465f1a904e802653ee33dec2.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

be8b267b465f1a904e802653ee33dec2.exe

description	pid	process	target process
PID 4412 wrote to memory of 1532	4412	be8b267b465f1a904e802653ee33dec2.exe	be8b267b465f1a904e802653ee33dec2.exe
PID 4412 wrote to memory of 1532	4412	be8b267b465f1a904e802653ee33dec2.exe	be8b267b465f1a904e802653ee33dec2.exe
PID 4412 wrote to memory of 1532	4412	be8b267b465f1a904e802653ee33dec2.exe	be8b267b465f1a904e802653ee33dec2.exe
PID 4412 wrote to memory of 1532	4412	be8b267b465f1a904e802653ee33dec2.exe	be8b267b465f1a904e802653ee33dec2.exe
PID 4412 wrote to memory of 1532	4412	be8b267b465f1a904e802653ee33dec2.exe	be8b267b465f1a904e802653ee33dec2.exe
PID 4412 wrote to memory of 1532	4412	be8b267b465f1a904e802653ee33dec2.exe	be8b267b465f1a904e802653ee33dec2.exe
PID 4412 wrote to memory of 1532	4412	be8b267b465f1a904e802653ee33dec2.exe	be8b267b465f1a904e802653ee33dec2.exe
PID 4412 wrote to memory of 1532	4412	be8b267b465f1a904e802653ee33dec2.exe	be8b267b465f1a904e802653ee33dec2.exe

C:\Users\Admin\AppData\Local\Temp\be8b267b465f1a904e802653ee33dec2.exe
C:\Users\Admin\AppData\Local\Temp\be8b267b465f1a904e802653ee33dec2.exe
2⤵
PID:1532

memory/1532-3-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1532-6-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1532-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1532-9-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4412-0-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4412-5-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download