a7e88b206189e8987e432b3f12a46e0222fe8e0d63faae65a3b9468471940dbf

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:27

Target

a7e88b206189e8987e432b3f12a46e0222fe8e0d63faae65a3b9468471940dbf.exe
Size

6.8MB
MD5

6e39361307aba1c82d6826c5a0e4b318
SHA1

7b87fd1454ac1dd5178358c5107cbd2adf12da54
SHA256

a7e88b206189e8987e432b3f12a46e0222fe8e0d63faae65a3b9468471940dbf
SHA512

bf20de807bfb1f8136941832c8946d93c6b9c98d14d0afb8363c1299ded494e129b0bb50929ee1d4d3e556be86de7eadee79a2bb6bdcfa15db41dffbaef67577
SSDEEP

196608:bhxRPAu3sL272iOGIWOYkBkzmDtIW9ASC:1zPI6StbxqzmDuW9ASC

Score

7^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7-zip32_2.dll	acprotect

Loads dropped DLL 2 IoCs

Processes:

a7e88b206189e8987e432b3f12a46e0222fe8e0d63faae65a3b9468471940dbf.exe

pid	process
2064	a7e88b206189e8987e432b3f12a46e0222fe8e0d63faae65a3b9468471940dbf.exe
2064	a7e88b206189e8987e432b3f12a46e0222fe8e0d63faae65a3b9468471940dbf.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/2064-0-0x0000000010000000-0x0000000010018000-memory.dmp	upx
behavioral2/memory/2064-2-0x0000000010000000-0x0000000010018000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\7-zip32_2.dll	upx
behavioral2/memory/2064-13-0x0000000007320000-0x00000000073BF000-memory.dmp	upx
behavioral2/memory/2064-43-0x0000000007320000-0x00000000073BF000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

a7e88b206189e8987e432b3f12a46e0222fe8e0d63faae65a3b9468471940dbf.exe

pid	process
2064	a7e88b206189e8987e432b3f12a46e0222fe8e0d63faae65a3b9468471940dbf.exe
2064	a7e88b206189e8987e432b3f12a46e0222fe8e0d63faae65a3b9468471940dbf.exe
2064	a7e88b206189e8987e432b3f12a46e0222fe8e0d63faae65a3b9468471940dbf.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a7e88b206189e8987e432b3f12a46e0222fe8e0d63faae65a3b9468471940dbf.exe

description	pid	process	target process
PID 2064 wrote to memory of 1084	2064	a7e88b206189e8987e432b3f12a46e0222fe8e0d63faae65a3b9468471940dbf.exe	cacls.exe
PID 2064 wrote to memory of 1084	2064	a7e88b206189e8987e432b3f12a46e0222fe8e0d63faae65a3b9468471940dbf.exe	cacls.exe
PID 2064 wrote to memory of 1084	2064	a7e88b206189e8987e432b3f12a46e0222fe8e0d63faae65a3b9468471940dbf.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\7-zip32_2.dll

Filesize
233KB

MD5
ea3df059beae86a3e186b2b179755e77

SHA1
babdcd6b5082c02fa2f5ebc2020f2cb3bbd77e8d

SHA256
1ab68a0c296281437fe638c8535309c6241ded4852608d940f5efcb8cc2d91a6

SHA512
1406d8083cfbd26e18aba74f6b45a09137bb3960f7afce5c5d0d790b0edb7277b7b885ed2ded9def12b667bcb37cbfb335884b2d7b8f08565743b674d1f053bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5761b7.tmp\data.ini

Filesize
1KB

MD5
65e0f66c653d969bf24ce14dfa79a86e

SHA1
20a12257be48a7a1a6b851e35b65dcd1434ec97d

SHA256
ca5960183f3582477795e5982e747e589925befb445b78bbbf7dbe8981ce692d

SHA512
dad1f558af789d60bbaa02d41d02ae0258c2ce4aef0bdc0821308078cd47b6e61d50d88964346708c4d3f8e7d4cb85bf8bce88ad35a76a95e67fcddb3868494d

Download Submit
memory/2064-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2064-2-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2064-3-0x0000000075819000-0x000000007581A000-memory.dmp

Filesize
4KB

Download
memory/2064-4-0x0000000075800000-0x00000000758F0000-memory.dmp

Filesize
960KB

Download
memory/2064-13-0x0000000007320000-0x00000000073BF000-memory.dmp

Filesize
636KB

Download
memory/2064-43-0x0000000007320000-0x00000000073BF000-memory.dmp

Filesize
636KB

Download
memory/2064-44-0x0000000075800000-0x00000000758F0000-memory.dmp

Filesize
960KB

Download