79e20f5b90c87395dd355f85e15ad3e115cd9a84750bc81a83f6b494ea33956a

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 04:52

Target

c27e5e35be0296af6e428efa6dd53c4e.exe
Size

68KB
MD5

c27e5e35be0296af6e428efa6dd53c4e
SHA1

bc48f1c6e70f63319bd6b6d6d884e794d6ea83c0
SHA256

79e20f5b90c87395dd355f85e15ad3e115cd9a84750bc81a83f6b494ea33956a
SHA512

2a0f5cb13c9610ffa177c813c9ab73b8949ca2dd1619a34ed9ee89457a9e8cc67e49f6dcc80f1e7714645b967accc552eca5ad3dc5bc94b8ee15ee47bea45c72
SSDEEP

768:nqvbC7IEIPKw6uCbP3wo8jwW/23KLI1a/5dfnweKBV8knQ1941d9zQjlakTIU9Zy:nWCdgo8D2aLIo/5pnBK3S4X9zQkyUB

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2792-4-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/2792-6-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/2792-9-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/2792-11-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2964 set thread context of 2792	2964	c27e5e35be0296af6e428efa6dd53c4e.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2056	2792	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2964	c27e5e35be0296af6e428efa6dd53c4e.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2792	2964	c27e5e35be0296af6e428efa6dd53c4e.exe	28
PID 2964 wrote to memory of 2792	2964	c27e5e35be0296af6e428efa6dd53c4e.exe	28
PID 2964 wrote to memory of 2792	2964	c27e5e35be0296af6e428efa6dd53c4e.exe	28
PID 2964 wrote to memory of 2792	2964	c27e5e35be0296af6e428efa6dd53c4e.exe	28
PID 2964 wrote to memory of 2792	2964	c27e5e35be0296af6e428efa6dd53c4e.exe	28
PID 2964 wrote to memory of 2792	2964	c27e5e35be0296af6e428efa6dd53c4e.exe	28
PID 2964 wrote to memory of 2792	2964	c27e5e35be0296af6e428efa6dd53c4e.exe	28
PID 2964 wrote to memory of 2792	2964	c27e5e35be0296af6e428efa6dd53c4e.exe	28
PID 2792 wrote to memory of 2056	2792	c27e5e35be0296af6e428efa6dd53c4e.exe	29
PID 2792 wrote to memory of 2056	2792	c27e5e35be0296af6e428efa6dd53c4e.exe	29
PID 2792 wrote to memory of 2056	2792	c27e5e35be0296af6e428efa6dd53c4e.exe	29
PID 2792 wrote to memory of 2056	2792	c27e5e35be0296af6e428efa6dd53c4e.exe	29

memory/2792-2-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2792-4-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2792-6-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2792-9-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2792-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2792-11-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download