e78ac3c6724948786fc9439817977ee281a93e7374962a123ee24175a78ae354

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 01:50

Target

e78ac3c6724948786fc9439817977ee281a93e7374962a123ee24175a78ae354.exe
Size

6.4MB
MD5

a03078c2de87c83b85e1385a12af5988
SHA1

b6a54cbc11d4d1ff8928c6672f069881cdc6c2a2
SHA256

e78ac3c6724948786fc9439817977ee281a93e7374962a123ee24175a78ae354
SHA512

3b0a99fbafd232497ef596f0a76401dcdc27d628aec3b2c76e6efd4c13355db79bc895d22330bf575c6f6e6bcaf355d7fdc285231f04cb7796bffa2ccdfaa07a
SSDEEP

196608:ThxRPAu3sJ5Qg9Vf57wWv8BUnOa+XjBUYu:NzPI3X9mYwUHYu

Score

7^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c00000001432c-8.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
3020	e78ac3c6724948786fc9439817977ee281a93e7374962a123ee24175a78ae354.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3020-0-0x0000000010000000-0x0000000010018000-memory.dmp	upx
behavioral1/files/0x000c00000001432c-8.dat	upx
behavioral1/memory/3020-10-0x0000000003460000-0x00000000034FF000-memory.dmp	upx
behavioral1/memory/3020-40-0x0000000003460000-0x00000000034FF000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2180	3020	e78ac3c6724948786fc9439817977ee281a93e7374962a123ee24175a78ae354.exe	28
PID 3020 wrote to memory of 2180	3020	e78ac3c6724948786fc9439817977ee281a93e7374962a123ee24175a78ae354.exe	28
PID 3020 wrote to memory of 2180	3020	e78ac3c6724948786fc9439817977ee281a93e7374962a123ee24175a78ae354.exe	28
PID 3020 wrote to memory of 2180	3020	e78ac3c6724948786fc9439817977ee281a93e7374962a123ee24175a78ae354.exe	28

C:\Users\Admin\AppData\Local\Temp\f762250.tmp\data.ini

Filesize
2KB

MD5
8ebdb8d9da160bf0e221629326e14ddb

SHA1
3ca00161134d03cd0db3e68f072c8159bf21c1e9

SHA256
e22723229fc410ceae6bf02dda79fdff0429b78eae728b72a42ea73d6655fb89

SHA512
5735a85b3ec75155fd4e33fd3ea84bf07a23dad85c9fab0225cc0b1831ddc4be636e910242168e55a2a14f6097ba2a04c0e6894702b07483048f978a2b45fb3f

Download Submit
\Users\Admin\AppData\Local\Temp\7-zip32_2.dll

Filesize
233KB

MD5
ea3df059beae86a3e186b2b179755e77

SHA1
babdcd6b5082c02fa2f5ebc2020f2cb3bbd77e8d

SHA256
1ab68a0c296281437fe638c8535309c6241ded4852608d940f5efcb8cc2d91a6

SHA512
1406d8083cfbd26e18aba74f6b45a09137bb3960f7afce5c5d0d790b0edb7277b7b885ed2ded9def12b667bcb37cbfb335884b2d7b8f08565743b674d1f053bb

Download Submit
memory/3020-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/3020-2-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/3020-4-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/3020-3-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/3020-10-0x0000000003460000-0x00000000034FF000-memory.dmp

Filesize
636KB

Download
memory/3020-40-0x0000000003460000-0x00000000034FF000-memory.dmp

Filesize
636KB

Download
memory/3020-41-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download