53adfc078ec8d34972a1f7d02b59164d8dd223365c8202de5fb27ecf505d2b27

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 19:16

Target

53adfc078ec8d34972a1f7d02b59164d8dd223365c8202de5fb27ecf505d2b27.exe
Size

401KB
MD5

6208e28a308543ac2bc5d7b1462cd689
SHA1

31f0835f9a478d01e31b80f719e02caa9973ebab
SHA256

53adfc078ec8d34972a1f7d02b59164d8dd223365c8202de5fb27ecf505d2b27
SHA512

91e5837aad3195bfdd9334315e5cdba698f44337e0a6711fced337c4cfe86a475058c7a88c327ccfdc45a8d0df3db25519eeb0717a7dff3d6e806fe95dc75eb1
SSDEEP

6144:nlwbi1nE3eJ/aUhQjrG+K5cb4T3Bi7w2bhafQEPx96w3KK6cDwSL0JVSGDoKo5yS:nKbveJ7hQjQvijd1Ev1L0TDhoD

Score

7^/10

agilenet

Loads dropped DLL 1 IoCs

Processes:

53adfc078ec8d34972a1f7d02b59164d8dd223365c8202de5fb27ecf505d2b27.exe

pid process

1752 53adfc078ec8d34972a1f7d02b59164d8dd223365c8202de5fb27ecf505d2b27.exe

pid	process
1752	53adfc078ec8d34972a1f7d02b59164d8dd223365c8202de5fb27ecf505d2b27.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral1/memory/1752-54-0x0000000000AB0000-0x0000000000B10000-memory.dmp	agile_net

C:\Users\Admin\AppData\Local\Temp\53adfc078ec8d34972a1f7d02b59164d8dd223365c8202de5fb27ecf505d2b27.exe
"C:\Users\Admin\AppData\Local\Temp\53adfc078ec8d34972a1f7d02b59164d8dd223365c8202de5fb27ecf505d2b27.exe"
1⤵
- Loads dropped DLL
PID:1752

\Users\Admin\AppData\Local\Temp\4098ed87-1f52-4d93-b25c-1515d3fa947a\AgileDotNetRT.dll
Filesize
136KB

MD5
9af5eb006bb0bab7f226272d82c896c7

SHA1
c2a5bb42a5f08f4dc821be374b700652262308f0

SHA256
77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

SHA512
7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

Download Submit
memory/1752-54-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Filesize
384KB

Download
memory/1752-57-0x0000000074820000-0x0000000074857000-memory.dmp

Filesize
220KB

Download