b2fa58be3711fb9c26b629832aa0ff68b333e224de3462b299665b465149870d

Analysis

max time kernel
36s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 08:32

Target

b2fa58be3711fb9c26b629832aa0ff68b333e224de3462b299665b465149870d.exe
Size

31KB
MD5

1a6c2c86e7f401a9e1c94d7b39da8f30
SHA1

bb520f3589b3dc5faa8aa613d54d52dd2dffb5f0
SHA256

b2fa58be3711fb9c26b629832aa0ff68b333e224de3462b299665b465149870d
SHA512

3fbc26238aa66a55e5bc4ae14b240ff7cad75a001f57a4ebb0d22c096adab50b1dca26bcbb868f231b3b03ab095a14967c02bc7d5d7e8c5bce97a79cfcd621e1
SSDEEP

768:2QjAqM3qE36tpZdI1yucQYJMzDuE3SVimChlIUCqnbcuyD7U:uqAq8cucQYJMzqE3S2lFnouy8

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1788-58-0x0000000000400000-0x0000000000511000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1656	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kr_done1	b2fa58be3711fb9c26b629832aa0ff68b333e224de3462b299665b465149870d.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1788	b2fa58be3711fb9c26b629832aa0ff68b333e224de3462b299665b465149870d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1656	1788	b2fa58be3711fb9c26b629832aa0ff68b333e224de3462b299665b465149870d.exe	29
PID 1788 wrote to memory of 1656	1788	b2fa58be3711fb9c26b629832aa0ff68b333e224de3462b299665b465149870d.exe	29
PID 1788 wrote to memory of 1656	1788	b2fa58be3711fb9c26b629832aa0ff68b333e224de3462b299665b465149870d.exe	29
PID 1788 wrote to memory of 1656	1788	b2fa58be3711fb9c26b629832aa0ff68b333e224de3462b299665b465149870d.exe	29

C:\Users\Admin\AppData\Local\Temp\b2fa58be3711fb9c26b629832aa0ff68b333e224de3462b299665b465149870d.exe
"C:\Users\Admin\AppData\Local\Temp\b2fa58be3711fb9c26b629832aa0ff68b333e224de3462b299665b465149870d.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\uninst06c5053.bat" "C:\Users\Admin\AppData\Local\Temp\b2fa58be3711fb9c26b629832aa0ff68b333e224de3462b299665b465149870d.exe""
  2⤵
  - Deletes itself
  PID:1656

C:\Users\Admin\AppData\Local\Temp\uninst06c5053.bat

Filesize
59B

MD5
2988b921fbed03f9c93c5d538932bbe3

SHA1
4b791b3d59ae76ff091c2cf201b40f5d1b432a3f

SHA256
a1769979622d3d25829be12474ad32ccfdfcac59785dac2fc10ae49c300e4ea3

SHA512
2920c6e9851973371dc238da1ee3c63d41c7820637856ee92c67e9489c1790e3fad287d229440d124e60b978f6819d04b47c40de9034cbd9de422aaafc2b07f9

Download Submit
memory/1656-60-0x0000000000000000-mapping.dmp

Download
memory/1788-58-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/1788-59-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download