a37e91e1d716524f1dae44f80984afa08d395d97f5d1f31fd86f9c763a5cde00

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 08:16

Target

d5a2beb19a8d6410116de578f66fd29f.exe
Size

100KB
MD5

d5a2beb19a8d6410116de578f66fd29f
SHA1

bb57f2b352394a1a8006a6b781a94157197cc0d6
SHA256

a37e91e1d716524f1dae44f80984afa08d395d97f5d1f31fd86f9c763a5cde00
SHA512

a67409920a24ff4f765bced26aba044efc9ec3086881606f313b5da6e2b60f1d10221d41a5e300116c2e0fc8b996e1aead9d3b6f5447fc60dea3f610c3765b5c
SSDEEP

3072:wWQ2FikzdErludwG5bqOjC/J/eETuOI4/FhWn6:wWi4cludRRC/J/esubMFh

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/320-0-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/320-7-0x0000000000400000-0x000000000044C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 320 set thread context of 1040	320	d5a2beb19a8d6410116de578f66fd29f.exe	88

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
320	d5a2beb19a8d6410116de578f66fd29f.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 1040	320	d5a2beb19a8d6410116de578f66fd29f.exe	88
PID 320 wrote to memory of 1040	320	d5a2beb19a8d6410116de578f66fd29f.exe	88
PID 320 wrote to memory of 1040	320	d5a2beb19a8d6410116de578f66fd29f.exe	88
PID 320 wrote to memory of 1040	320	d5a2beb19a8d6410116de578f66fd29f.exe	88
PID 320 wrote to memory of 1040	320	d5a2beb19a8d6410116de578f66fd29f.exe	88
PID 320 wrote to memory of 1040	320	d5a2beb19a8d6410116de578f66fd29f.exe	88
PID 320 wrote to memory of 1040	320	d5a2beb19a8d6410116de578f66fd29f.exe	88

C:\Users\Admin\AppData\Local\Temp\d5a2beb19a8d6410116de578f66fd29f.exe
"C:\Users\Admin\AppData\Local\Temp\d5a2beb19a8d6410116de578f66fd29f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320
- C:\Users\Admin\AppData\Local\Temp\d5a2beb19a8d6410116de578f66fd29f.exe
  C:\Users\Admin\AppData\Local\Temp\d5a2beb19a8d6410116de578f66fd29f.exe
  2⤵
  PID:1040

memory/320-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/320-7-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1040-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1040-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1040-5-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1040-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1040-9-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1040-10-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/1040-11-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download