dc3d2ea016b660ab42184e636ec0abb6fcfcbaf570894fc31110345e3a4c7c05

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 16:50

Target

de7b7080a37214536cb3f6639293871a.exe
Size

266KB
MD5

de7b7080a37214536cb3f6639293871a
SHA1

baf685dbf80e024abf38459ee0749dd11075244a
SHA256

dc3d2ea016b660ab42184e636ec0abb6fcfcbaf570894fc31110345e3a4c7c05
SHA512

75585633e692eff5a217a773b6b5388c62e340725ccc070430a0c92f7bede917bb1fe4509ebbeea5f0250020b8322b1df080d24cd6eb6ce82939522b232703a2
SSDEEP

384:aGcCSl60jDWbeC6A6w1GaiEGcCSLR08ZZuOK9Bm/L:Zd0QeZjUivE084T94

Score

7^/10

upx

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2192-4-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2192-6-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2192-9-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2192-12-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2192-14-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2192-13-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2192-11-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2192-18-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2212 set thread context of 2192	2212	de7b7080a37214536cb3f6639293871a.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2848	2212	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2212	de7b7080a37214536cb3f6639293871a.exe
2192	de7b7080a37214536cb3f6639293871a.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2192	2212	de7b7080a37214536cb3f6639293871a.exe	28
PID 2212 wrote to memory of 2192	2212	de7b7080a37214536cb3f6639293871a.exe	28
PID 2212 wrote to memory of 2192	2212	de7b7080a37214536cb3f6639293871a.exe	28
PID 2212 wrote to memory of 2192	2212	de7b7080a37214536cb3f6639293871a.exe	28
PID 2212 wrote to memory of 2192	2212	de7b7080a37214536cb3f6639293871a.exe	28
PID 2212 wrote to memory of 2192	2212	de7b7080a37214536cb3f6639293871a.exe	28
PID 2212 wrote to memory of 2192	2212	de7b7080a37214536cb3f6639293871a.exe	28
PID 2212 wrote to memory of 2192	2212	de7b7080a37214536cb3f6639293871a.exe	28
PID 2212 wrote to memory of 2848	2212	de7b7080a37214536cb3f6639293871a.exe	29
PID 2212 wrote to memory of 2848	2212	de7b7080a37214536cb3f6639293871a.exe	29
PID 2212 wrote to memory of 2848	2212	de7b7080a37214536cb3f6639293871a.exe	29
PID 2212 wrote to memory of 2848	2212	de7b7080a37214536cb3f6639293871a.exe	29

C:\Users\Admin\AppData\Local\Temp\de7b7080a37214536cb3f6639293871a.exe
"C:\Users\Admin\AppData\Local\Temp\de7b7080a37214536cb3f6639293871a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\de7b7080a37214536cb3f6639293871a.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 192
  2⤵
  - Program crash
  PID:2848

memory/2192-2-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2192-4-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2192-6-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2192-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2192-9-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2192-12-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2192-14-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2192-13-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2192-11-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2192-18-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download