38e1821b1289f087cfd17799a47081a368348fdef2c45dd216390269f8e52bb3

Analysis

max time kernel
158s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 04:29

Target

38e1821b1289f087cfd17799a47081a368348fdef2c45dd216390269f8e52bb3.exe
Size

381KB
MD5

a6a4daa74d974f2d92b35392207070ce
SHA1

6ece78cd87fe221ec4113cad8d41bef2475408ea
SHA256

38e1821b1289f087cfd17799a47081a368348fdef2c45dd216390269f8e52bb3
SHA512

7a1cc21ec30728aadc04146b3a4acaf1b46359d49058a2143e08aa9f999360e92e80f968d0ca820d32959b08028aa3639796564b24c7474bc6a8f38aade19a91
SSDEEP

6144:WVYmoP2D+6u6e1t0pjWcLCWhc6bTQUzjyvmELZ/lsyw03SxOqtLOoaMVVKlFUB7G:m2Pn6uN/0BjCacrEjyvRtTGrtLLqle9G

Score

7^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\xei30EE.tmp	acprotect

Loads dropped DLL 2 IoCs

Processes:

38e1821b1289f087cfd17799a47081a368348fdef2c45dd216390269f8e52bb3.exe

pid	process
5008	38e1821b1289f087cfd17799a47081a368348fdef2c45dd216390269f8e52bb3.exe
5008	38e1821b1289f087cfd17799a47081a368348fdef2c45dd216390269f8e52bb3.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/5008-0-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/5008-8-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/5008-10-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/5008-16-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

38e1821b1289f087cfd17799a47081a368348fdef2c45dd216390269f8e52bb3.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4800

C:\Users\Admin\AppData\Local\Temp\xei30EE.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
memory/5008-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5008-6-0x0000000000730000-0x00000000007A3000-memory.dmp

Filesize
460KB

Download
memory/5008-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5008-9-0x0000000000730000-0x00000000007A3000-memory.dmp

Filesize
460KB

Download
memory/5008-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5008-13-0x0000000000730000-0x00000000007A3000-memory.dmp

Filesize
460KB

Download
memory/5008-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5008-37-0x0000000000730000-0x00000000007A3000-memory.dmp

Filesize
460KB

Download