a1efe2edf4e4809913e02052789fba49f3013a8641efbce3c7e180e9267b5d0c

Analysis

max time kernel
15s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 11:43

Target

a1efe2edf4e4809913e02052789fba49f3013a8641efbce3c7e180e9267b5d0c.exe
Size

33KB
MD5

982ebedd5375f33ebf69c8fcb20cdc39
SHA1

c0f7abe45b578c1001ee3f85f17a7d24e69c7672
SHA256

a1efe2edf4e4809913e02052789fba49f3013a8641efbce3c7e180e9267b5d0c
SHA512

9f837b2fd6a336afd8d579cc0d29eb1f9f36507af35dbcab336a7657adf86df363597fa810108c5a211daf0f0a8e53f346c613f76ed892335f41ab28453aa662
SSDEEP

768:CuHcjZIifJNqDj3ZVpKWvwKfCWqM0TQgNCefzcx7/tmWXKRJwMpM7u:XrifJNq5VpKWvbD90Tk0wRt7IR

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1224-54-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1628-55-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1628-56-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Notify.sys	a1efe2edf4e4809913e02052789fba49f3013a8641efbce3c7e180e9267b5d0c.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

C:\Users\Admin\AppData\Local\Temp\a1efe2edf4e4809913e02052789fba49f3013a8641efbce3c7e180e9267b5d0c.exe
"C:\Users\Admin\AppData\Local\Temp\a1efe2edf4e4809913e02052789fba49f3013a8641efbce3c7e180e9267b5d0c.exe"
1⤵
PID:1224

C:\Users\Admin\AppData\Local\Temp\a1efe2edf4e4809913e02052789fba49f3013a8641efbce3c7e180e9267b5d0c.exe
C:\Users\Admin\AppData\Local\Temp\a1efe2edf4e4809913e02052789fba49f3013a8641efbce3c7e180e9267b5d0c.exe
1⤵
- Drops file in System32 directory
PID:1628

memory/1224-54-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1628-55-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1628-56-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download