fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:16

Target

fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe
Size

711KB
MD5

6956630ee4efe1b3723f37e5c31bf569
SHA1

be0ed06ecd81d6782349cd2a8781596c52d4cd46
SHA256

fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1
SHA512

c7035fffbcbe070506bb36701edfe0466f02c1fa2904b12ba1f7072e69aee15a55e5317f54c4f3704c9f2fce1655b6c5524d2f288a60c8b56f9f8a7edceb6464
SSDEEP

12288:Ligd6+hkpstM13N91AzHvCCQXgRwggo7liW1eIe0H2lztV6Y+yaxXog8kFeXsLhg:+e6+hv+991AzPC2DlpiW1ApXottQpu

Score

9^/10

Detects executables packed with SmartAssembly 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2200-4-0x00000000020C0000-0x00000000020DC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

Processes:

fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe

description	pid	process	target process
PID 2200 set thread context of 2532	2200	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe

description	pid	process	target process
PID 2200 wrote to memory of 2532	2200	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe
PID 2200 wrote to memory of 2532	2200	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe
PID 2200 wrote to memory of 2532	2200	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe
PID 2200 wrote to memory of 2532	2200	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe

C:\Users\Admin\AppData\Local\Temp\fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe
"C:\Users\Admin\AppData\Local\Temp\fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe
  C:\Users\Admin\AppData\Local\Temp\fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe
  2⤵
  PID:2532

memory/2200-0-0x000007FEF5C93000-0x000007FEF5C94000-memory.dmp

Filesize
4KB

Download
memory/2200-1-0x00000000009E0000-0x0000000000A96000-memory.dmp

Filesize
728KB

Download
memory/2200-2-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Filesize
9.9MB

Download
memory/2200-3-0x000000001A680000-0x000000001A72C000-memory.dmp

Filesize
688KB

Download
memory/2200-4-0x00000000020C0000-0x00000000020DC000-memory.dmp

Filesize
112KB

Download
memory/2200-5-0x0000000000570000-0x0000000000584000-memory.dmp

Filesize
80KB

Download
memory/2200-6-0x000000001B830000-0x000000001B8B8000-memory.dmp

Filesize
544KB

Download
memory/2200-9-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Filesize
9.9MB

Download
memory/2532-7-0x000007FFFFFDD000-0x000007FFFFFDE000-memory.dmp

Filesize
4KB

Download