a0c324293320453116850f0e265f3cb24e1cbb99490a83083f5c38d1a3169abe

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 15:46

Target

cbcdce9e545007658296d22fe1d30777.exe
Size

187KB
MD5

cbcdce9e545007658296d22fe1d30777
SHA1

394b1c58deaca92926cef1e585110ace9c4ddbbd
SHA256

a0c324293320453116850f0e265f3cb24e1cbb99490a83083f5c38d1a3169abe
SHA512

9a681fa0d1ecb5002714f74c76dd46d4abf72f0030ce4d52cb08b4ea55b9b07d8aaea0ee4ba19aca846482bd2120c291baa65d4fe45a21b24e1fe7d76084b071
SSDEEP

1536:hBtpNK+PXWmpAYvnZhPngupZNEtOUWAU2BjJiC1u6blBy24D/SNtY3Q8RYuvWyNb:hBtp/IYnwVxQobDmNaI

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/708-0-0x0000000000400000-0x0000000000493000-memory.dmp	upx
behavioral2/memory/708-6-0x0000000000400000-0x0000000000493000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 708 set thread context of 4372	708	cbcdce9e545007658296d22fe1d30777.exe	98

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2400	4372	WerFault.exe	98

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
708	cbcdce9e545007658296d22fe1d30777.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 4372	708	cbcdce9e545007658296d22fe1d30777.exe	98
PID 708 wrote to memory of 4372	708	cbcdce9e545007658296d22fe1d30777.exe	98
PID 708 wrote to memory of 4372	708	cbcdce9e545007658296d22fe1d30777.exe	98
PID 708 wrote to memory of 4372	708	cbcdce9e545007658296d22fe1d30777.exe	98
PID 708 wrote to memory of 4372	708	cbcdce9e545007658296d22fe1d30777.exe	98
PID 708 wrote to memory of 4372	708	cbcdce9e545007658296d22fe1d30777.exe	98
PID 708 wrote to memory of 4372	708	cbcdce9e545007658296d22fe1d30777.exe	98

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4372 -ip 4372
1⤵
PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3276 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:892

memory/708-0-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/708-6-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4372-3-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/4372-5-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/4372-7-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/4372-8-0x0000000000400000-0x0000000000401C00-memory.dmp

Filesize
7KB

Download