c262a6717c7252526d52535a0b26b1e782004fe023a0ad8066b1311b3782ca14

Analysis

max time kernel
111s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 19:40

Target

c262a6717c7252526d52535a0b26b1e782004fe023a0ad8066b1311b3782ca14.exe
Size

84KB
MD5

0343cd766a947e7fdb208b37bddae49d
SHA1

32fac91f838b74b292679c85b5c4c4510d0aa209
SHA256

c262a6717c7252526d52535a0b26b1e782004fe023a0ad8066b1311b3782ca14
SHA512

086f316cd8b065a4111d961c6df9e657228d1a8f64e35c6ff72475c9fdda210a6ef8a3c0f3cbe3cab704f526ba1574ede7f33fd38d9869d3259658b8f04dc232
SSDEEP

1536:z9b37JxBAfcuagSXXmyOBrcH0kVDZbmaacDzIX0dztL7P7u8zC5mR+S8f:537/BA3agSHmyOVcUO8Rat/uq9/a

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/384-132-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/384-133-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\totzs	c262a6717c7252526d52535a0b26b1e782004fe023a0ad8066b1311b3782ca14.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\totzs	c262a6717c7252526d52535a0b26b1e782004fe023a0ad8066b1311b3782ca14.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	c262a6717c7252526d52535a0b26b1e782004fe023a0ad8066b1311b3782ca14.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	c262a6717c7252526d52535a0b26b1e782004fe023a0ad8066b1311b3782ca14.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	c262a6717c7252526d52535a0b26b1e782004fe023a0ad8066b1311b3782ca14.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\totzs\\command	c262a6717c7252526d52535a0b26b1e782004fe023a0ad8066b1311b3782ca14.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	c262a6717c7252526d52535a0b26b1e782004fe023a0ad8066b1311b3782ca14.exe

C:\Users\Admin\AppData\Local\Temp\c262a6717c7252526d52535a0b26b1e782004fe023a0ad8066b1311b3782ca14.exe
"C:\Users\Admin\AppData\Local\Temp\c262a6717c7252526d52535a0b26b1e782004fe023a0ad8066b1311b3782ca14.exe"
1⤵
- Modifies registry class
PID:384

memory/384-132-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/384-133-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download