dbd8fe6a864d513fb7a14c264cde26b132e47196a088f34842978cefaad2201a

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 16:53

Target

NEAS.ff228ef57012d7b98aabcc89d8e77dd0.exe
Size

22KB
MD5

ff228ef57012d7b98aabcc89d8e77dd0
SHA1

9fdfbdd51c841f8434e66634608e324cc34fa1d6
SHA256

dbd8fe6a864d513fb7a14c264cde26b132e47196a088f34842978cefaad2201a
SHA512

2c9c554f1bc014491044fa0412e8f684e79d0cf39acec19a3f4e4e6f773e0c2e127b8208acb2c8d4dc19e44b3e38d3c4a397dcc6f970b36b3a3c6aed800b89bd
SSDEEP

384:ErzP/kysDMEAsy/9z6xcU2uTTgJwSK5YBV26Bcjze+wW5ton0LSo8O:Erz8rDHSR6Wl2gZKizyzeS5t6IGO

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
3388	rmass.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x00090000000224ad-3.dat	upx
behavioral2/memory/3388-4-0x0000000000400000-0x0000000000411000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rmass.exe	NEAS.ff228ef57012d7b98aabcc89d8e77dd0.exe
File opened for modification	C:\Windows\SysWOW64\rmass.exe	NEAS.ff228ef57012d7b98aabcc89d8e77dd0.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.ff228ef57012d7b98aabcc89d8e77dd0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ff228ef57012d7b98aabcc89d8e77dd0.exe"
1⤵
- Drops file in System32 directory
PID:4384
- C:\Windows\SysWOW64\rmass.exe
  "C:\Windows\SysWOW64\rmass.exe"
  2⤵
  - Executes dropped EXE
  PID:3388

C:\Windows\SysWOW64\rmass.exe

Filesize
19KB

MD5
fd7e82bfdf5e5082eb0e4e873225cbfd

SHA1
83aab23a8710289f1989add6b3d99b8920ef66b6

SHA256
4bfc34f9cad007129e7eeda147c00fd16f0d8cb8f5b236cca8f0617338843497

SHA512
cce062f804eca641ea0f6c7874836418bd01569473501bc09ef6f3f8e9ccf23625ddc71471375504695ce873f45d6817991156d76079a5309390e2d4c3d793bc

Download Submit
memory/3388-4-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4384-0-0x0000000076EF2000-0x0000000076EF3000-memory.dmp

Filesize
4KB

Download
memory/4384-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download