e355a04597be8601d532e48cc0a26a3dd3d0389806bcdbae922c19b2e17c8783

Analysis

max time kernel
110s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 07:25

Target

650dc9ce3fc06aa7468b991e593997d0N.exe
Size

772KB
MD5

650dc9ce3fc06aa7468b991e593997d0
SHA1

394dcb32922d952e55fba74d170cea51036aea4e
SHA256

e355a04597be8601d532e48cc0a26a3dd3d0389806bcdbae922c19b2e17c8783
SHA512

73ceac3fe8c5c825a42b51e0113605239f6eab7b2039cdece286f71907d0060f01c43e05617437b25f7198345e61c72c1258ed6ad77247f5e6b22daeb9d038fc
SSDEEP

12288:5VCSFSEvZIZvYrsUwkwxizgPsYmBwolM+e5KLehq/JZZtcaC0fBPsSpB:57SKoUXwkRMCK5oKqBxcaCGsi

Score

7^/10

upx

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1448-4-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral1/memory/1448-2-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral1/memory/1448-10-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral1/memory/1448-9-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral1/memory/1448-12-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral1/memory/1448-11-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral1/memory/1448-14-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral1/memory/1448-13-0x0000000000400000-0x00000000004F8000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1320 set thread context of 1448	1320	650dc9ce3fc06aa7468b991e593997d0N.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1520	1448	WerFault.exe	30

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1448	1320	650dc9ce3fc06aa7468b991e593997d0N.exe	30
PID 1320 wrote to memory of 1448	1320	650dc9ce3fc06aa7468b991e593997d0N.exe	30
PID 1320 wrote to memory of 1448	1320	650dc9ce3fc06aa7468b991e593997d0N.exe	30
PID 1320 wrote to memory of 1448	1320	650dc9ce3fc06aa7468b991e593997d0N.exe	30
PID 1320 wrote to memory of 1448	1320	650dc9ce3fc06aa7468b991e593997d0N.exe	30
PID 1320 wrote to memory of 1448	1320	650dc9ce3fc06aa7468b991e593997d0N.exe	30
PID 1320 wrote to memory of 1448	1320	650dc9ce3fc06aa7468b991e593997d0N.exe	30
PID 1320 wrote to memory of 1448	1320	650dc9ce3fc06aa7468b991e593997d0N.exe	30
PID 1448 wrote to memory of 1520	1448	650dc9ce3fc06aa7468b991e593997d0N.exe	31
PID 1448 wrote to memory of 1520	1448	650dc9ce3fc06aa7468b991e593997d0N.exe	31
PID 1448 wrote to memory of 1520	1448	650dc9ce3fc06aa7468b991e593997d0N.exe	31
PID 1448 wrote to memory of 1520	1448	650dc9ce3fc06aa7468b991e593997d0N.exe	31

memory/1448-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1448-4-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1448-2-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1448-0-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1448-10-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1448-9-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1448-12-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1448-11-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1448-14-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1448-13-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download