3676bab2ad5cab192a782dca7312b9cdf24925a97baa55927599c85bbc18996e

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 20:20

Target

3676bab2ad5cab192a782dca7312b9cdf24925a97baa55927599c85bbc18996e.exe
Size

42KB
MD5

d9cb3abe37423e96515b0aa042551b1f
SHA1

2754ce2ce023a55a1401010bb9ec30fef2160525
SHA256

3676bab2ad5cab192a782dca7312b9cdf24925a97baa55927599c85bbc18996e
SHA512

975666345391ccce0d46ebecacf6cf531adcf8c613112269879c8c3c60a6cdcb09554946295313c34262a518d3b4e268168e7bfe978894db15e11e1fd82ed419
SSDEEP

768:bWjuw5kgv4rSdcIddTOQioj9keIeuvW7gUV/4SkWxHqA0jgU5FxfthjLHSXPM0+H:Kj/XQrNIv7ioBkeqvWkMRN08U53nY00I

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
1276	System64.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0008000000005c51-55.dat	upx
behavioral1/memory/1448-57-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1276-58-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1448-59-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\System64.exe	3676bab2ad5cab192a782dca7312b9cdf24925a97baa55927599c85bbc18996e.exe
File opened for modification	C:\Windows\SysWOW64\System64.exe	3676bab2ad5cab192a782dca7312b9cdf24925a97baa55927599c85bbc18996e.exe

C:\Users\Admin\AppData\Local\Temp\3676bab2ad5cab192a782dca7312b9cdf24925a97baa55927599c85bbc18996e.exe
"C:\Users\Admin\AppData\Local\Temp\3676bab2ad5cab192a782dca7312b9cdf24925a97baa55927599c85bbc18996e.exe"
1⤵
- Drops file in System32 directory
PID:1448

C:\Windows\SysWOW64\System64.exe
C:\Windows\SysWOW64\System64.exe
1⤵
- Executes dropped EXE
PID:1276

C:\Windows\SysWOW64\System64.exe

Filesize
42KB

MD5
d9cb3abe37423e96515b0aa042551b1f

SHA1
2754ce2ce023a55a1401010bb9ec30fef2160525

SHA256
3676bab2ad5cab192a782dca7312b9cdf24925a97baa55927599c85bbc18996e

SHA512
975666345391ccce0d46ebecacf6cf531adcf8c613112269879c8c3c60a6cdcb09554946295313c34262a518d3b4e268168e7bfe978894db15e11e1fd82ed419

Download Submit
memory/1276-58-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1448-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1448-57-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1448-59-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download