2f70460b7899abca251189c52dd0008953cc1eed5dba4b690c1475b33a70de48

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 12:37

Target

VirusShare_46cc98d1a3df02e13d49998b7f1f1302.exe
Size

199KB
MD5

46cc98d1a3df02e13d49998b7f1f1302
SHA1

adedfac306b99d5b39369c31eda56ac0733265e9
SHA256

2f70460b7899abca251189c52dd0008953cc1eed5dba4b690c1475b33a70de48
SHA512

d82222a6d5844b19cffd6434be65d0ca5f267154e17162d883a916bb77ce9336a37f9a879e378f7db3b3a7980b126d7ee3e73e94252ee67376eb552abdbed060
SSDEEP

3072:G92R+j8gOSA+pjj4cPLC9g2NcbuyH0zDkqZBvKWYTquXjpQp3V072uzEwS2x7J87:k2rgjpj5H0VFYTqKIGvzEwxauTIBu

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2684-0-0x0000000000400000-0x0000000000449000-memory.dmp	upx
behavioral2/memory/2684-10-0x0000000000400000-0x0000000000449000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2684 set thread context of 2968	2684	VirusShare_46cc98d1a3df02e13d49998b7f1f1302.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2684	VirusShare_46cc98d1a3df02e13d49998b7f1f1302.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2968	2684	VirusShare_46cc98d1a3df02e13d49998b7f1f1302.exe	80
PID 2684 wrote to memory of 2968	2684	VirusShare_46cc98d1a3df02e13d49998b7f1f1302.exe	80
PID 2684 wrote to memory of 2968	2684	VirusShare_46cc98d1a3df02e13d49998b7f1f1302.exe	80
PID 2684 wrote to memory of 2968	2684	VirusShare_46cc98d1a3df02e13d49998b7f1f1302.exe	80
PID 2684 wrote to memory of 2968	2684	VirusShare_46cc98d1a3df02e13d49998b7f1f1302.exe	80
PID 2684 wrote to memory of 2968	2684	VirusShare_46cc98d1a3df02e13d49998b7f1f1302.exe	80
PID 2684 wrote to memory of 2968	2684	VirusShare_46cc98d1a3df02e13d49998b7f1f1302.exe	80
PID 2684 wrote to memory of 2968	2684	VirusShare_46cc98d1a3df02e13d49998b7f1f1302.exe	80

C:\Users\Admin\AppData\Local\Temp\VirusShare_46cc98d1a3df02e13d49998b7f1f1302.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_46cc98d1a3df02e13d49998b7f1f1302.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Local\Temp\VirusShare_46cc98d1a3df02e13d49998b7f1f1302.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_46cc98d1a3df02e13d49998b7f1f1302.exe"
  2⤵
  PID:2968

memory/2684-0-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2684-10-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2968-3-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2968-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2968-8-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2968-5-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download