b50b34fb6d1a09997caa2b7906fd26b7ac6688625d84f004cbe479b606e6b7d1

Analysis

max time kernel
38s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:22

Target

b50b34fb6d1a09997caa2b7906fd26b7ac6688625d84f004cbe479b606e6b7d1.exe
Size

128KB
MD5

34e16495389f62567f839f6127fa51a5
SHA1

3046c8c9397ab432387afbc4cc7db365f4ae7af5
SHA256

b50b34fb6d1a09997caa2b7906fd26b7ac6688625d84f004cbe479b606e6b7d1
SHA512

967c708f8522b0a62f11ddeaca33fdaff7000bd5275e15560156b3d192987ba2ca73710b925300ddcb51a5631b320c6ebf6c2a26f913e43064c6411492abad4a
SSDEEP

1536:jV5ZpdSNrdRYnk9boD3cxSy8yPv25DFnmBTAerXDZR5ctTY5MTHaoO:NfSjMk9bGcxd25DwnrDVYY5MT6oO

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1504-54-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/1504-55-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Modifies registry class 7 IoCs

Processes:

b50b34fb6d1a09997caa2b7906fd26b7ac6688625d84f004cbe479b606e6b7d1.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	b50b34fb6d1a09997caa2b7906fd26b7ac6688625d84f004cbe479b606e6b7d1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	b50b34fb6d1a09997caa2b7906fd26b7ac6688625d84f004cbe479b606e6b7d1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\xrivk\\command	b50b34fb6d1a09997caa2b7906fd26b7ac6688625d84f004cbe479b606e6b7d1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	b50b34fb6d1a09997caa2b7906fd26b7ac6688625d84f004cbe479b606e6b7d1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\xrivk	b50b34fb6d1a09997caa2b7906fd26b7ac6688625d84f004cbe479b606e6b7d1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\xrivk	b50b34fb6d1a09997caa2b7906fd26b7ac6688625d84f004cbe479b606e6b7d1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	b50b34fb6d1a09997caa2b7906fd26b7ac6688625d84f004cbe479b606e6b7d1.exe

C:\Users\Admin\AppData\Local\Temp\b50b34fb6d1a09997caa2b7906fd26b7ac6688625d84f004cbe479b606e6b7d1.exe
"C:\Users\Admin\AppData\Local\Temp\b50b34fb6d1a09997caa2b7906fd26b7ac6688625d84f004cbe479b606e6b7d1.exe"
1⤵
- Modifies registry class
PID:1504

memory/1504-54-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1504-55-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download