cab20e4df3a1d5b5953bfab2ee7b7639efc21d5d15136017777a301df048ebb0

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:50

Target

04643802b89af8e515318d208a7bd7d2.exe
Size

86KB
MD5

04643802b89af8e515318d208a7bd7d2
SHA1

26c3d2803de4f95b6ba06f375e0a7c9a60bdaba6
SHA256

cab20e4df3a1d5b5953bfab2ee7b7639efc21d5d15136017777a301df048ebb0
SHA512

1df50ba245ecb60a068e29218045d830811d36c95988d84a25c5ee21f55fa508df59510f4850d7a818e83a5199b6d29e42e03734650653641ef3463ee7bf573d
SSDEEP

1536:+3vItJToWt1yoSv9vYvsVjbzOa2BVOBbrkjy1UQFYnnU1EbOZ8Z:4vSag1yrdVj+YB1UaYnaN4

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3068-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\chzmn\\command	04643802b89af8e515318d208a7bd7d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	04643802b89af8e515318d208a7bd7d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\chzmn	04643802b89af8e515318d208a7bd7d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\chzmn	04643802b89af8e515318d208a7bd7d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	04643802b89af8e515318d208a7bd7d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	04643802b89af8e515318d208a7bd7d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	04643802b89af8e515318d208a7bd7d2.exe

C:\Users\Admin\AppData\Local\Temp\04643802b89af8e515318d208a7bd7d2.exe
"C:\Users\Admin\AppData\Local\Temp\04643802b89af8e515318d208a7bd7d2.exe"
1⤵
- Modifies registry class
PID:3068

memory/3068-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download