a0c324293320453116850f0e265f3cb24e1cbb99490a83083f5c38d1a3169abe

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 15:46

Target

cbcdce9e545007658296d22fe1d30777.exe
Size

187KB
MD5

cbcdce9e545007658296d22fe1d30777
SHA1

394b1c58deaca92926cef1e585110ace9c4ddbbd
SHA256

a0c324293320453116850f0e265f3cb24e1cbb99490a83083f5c38d1a3169abe
SHA512

9a681fa0d1ecb5002714f74c76dd46d4abf72f0030ce4d52cb08b4ea55b9b07d8aaea0ee4ba19aca846482bd2120c291baa65d4fe45a21b24e1fe7d76084b071
SSDEEP

1536:hBtpNK+PXWmpAYvnZhPngupZNEtOUWAU2BjJiC1u6blBy24D/SNtY3Q8RYuvWyNb:hBtp/IYnwVxQobDmNaI

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2860-0-0x0000000000400000-0x0000000000493000-memory.dmp	upx
behavioral1/memory/2860-3-0x0000000001E10000-0x0000000001EA3000-memory.dmp	upx
behavioral1/memory/2860-11-0x0000000000400000-0x0000000000493000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 1132	2860	cbcdce9e545007658296d22fe1d30777.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2860	cbcdce9e545007658296d22fe1d30777.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1132	2860	cbcdce9e545007658296d22fe1d30777.exe	28
PID 2860 wrote to memory of 1132	2860	cbcdce9e545007658296d22fe1d30777.exe	28
PID 2860 wrote to memory of 1132	2860	cbcdce9e545007658296d22fe1d30777.exe	28
PID 2860 wrote to memory of 1132	2860	cbcdce9e545007658296d22fe1d30777.exe	28
PID 2860 wrote to memory of 1132	2860	cbcdce9e545007658296d22fe1d30777.exe	28
PID 2860 wrote to memory of 1132	2860	cbcdce9e545007658296d22fe1d30777.exe	28
PID 2860 wrote to memory of 1132	2860	cbcdce9e545007658296d22fe1d30777.exe	28
PID 2860 wrote to memory of 1132	2860	cbcdce9e545007658296d22fe1d30777.exe	28

C:\Users\Admin\AppData\Local\Temp\cbcdce9e545007658296d22fe1d30777.exe
"C:\Users\Admin\AppData\Local\Temp\cbcdce9e545007658296d22fe1d30777.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\cbcdce9e545007658296d22fe1d30777.exe
  "C:\Users\Admin\AppData\Local\Temp\cbcdce9e545007658296d22fe1d30777.exe"
  2⤵
  PID:1132

memory/1132-4-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1132-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1132-8-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1132-9-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1132-10-0x0000000000400000-0x0000000000401C00-memory.dmp

Filesize
7KB

Download
memory/2860-0-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2860-3-0x0000000001E10000-0x0000000001EA3000-memory.dmp

Filesize
588KB

Download
memory/2860-11-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download