ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31

Analysis

max time kernel
257s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 05:21

Target

ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe
Size

171KB
MD5

3d6b4b820acc44222c658770f35701af
SHA1

0eb736a45150cde25549faf48fde2070da9b88e5
SHA256

ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31
SHA512

33c277f25f7e9d757e8be57667731f9a813d6429a11cbe5e7517602c2189990aabda5a0a864cdc97a7c9f2ad24ce8abbbb8f6414f6852529b1a9989ba68b8a83
SSDEEP

3072:lDA4sbgkfxE+U/uUISGLL+p0+mjhIlteWd:lXsbhxE+MfcI

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
1836	msa.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/772-55-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/772-56-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/1836-61-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/772-62-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/1836-63-0x0000000000400000-0x0000000000477000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job	ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe
File opened for modification	C:\Windows\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job	ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe
File created	C:\Windows\msa.exe	ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe
File opened for modification	C:\Windows\msa.exe	ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe
File created	C:\Windows\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job	msa.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
772	ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe
1836	msa.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 1836	772	ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe	27
PID 772 wrote to memory of 1836	772	ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe	27
PID 772 wrote to memory of 1836	772	ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe	27
PID 772 wrote to memory of 1836	772	ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31.exe	27

C:\Windows\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job

Filesize
408B

MD5
f474e29f2f5fc1ca5b46dd6d9fde6584

SHA1
e701d3f109129759d052bb4a0fc708de35e9a739

SHA256
9d3c90e076b65ee6eaa34b475d406a7849ecb048aec054a4402c19aec37206d7

SHA512
496c7d325df98fe4c700e864fe9a1a6b3acf6507297cd4aeacf4b3c7e25d602a2403a1232f071a5f15d217f076e55ecd258cf9ed653bcd073481761c236acddf

Download Submit
C:\Windows\msa.exe

Filesize
171KB

MD5
3d6b4b820acc44222c658770f35701af

SHA1
0eb736a45150cde25549faf48fde2070da9b88e5

SHA256
ae64363e218d348417e17daf329c51b1b7dad6dcb5d072345687381b05627f31

SHA512
33c277f25f7e9d757e8be57667731f9a813d6429a11cbe5e7517602c2189990aabda5a0a864cdc97a7c9f2ad24ce8abbbb8f6414f6852529b1a9989ba68b8a83

Download Submit
memory/772-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/772-55-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/772-56-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/772-62-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1836-61-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1836-63-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download