45d6605ac9c1b1e888dca429805e15ef616bf42600fb1ac7bc1d55e037a1a70a

Analysis

max time kernel
147s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:49

Target

11f0e9c5e823f34c03ae46220068f29b.exe
Size

238KB
MD5

11f0e9c5e823f34c03ae46220068f29b
SHA1

00578c936ebd94c7d72ed1a0d6c709a1f4001656
SHA256

45d6605ac9c1b1e888dca429805e15ef616bf42600fb1ac7bc1d55e037a1a70a
SHA512

e93ef8b8c483639be0921d531f627baa06c9d0fa635250fff41ccb82a0e85951349a909fb6b640c52aad22077c2d62fd8a24b9c368e01ecbdb2a16c3646a7520
SSDEEP

3072:R9vLuDchlt3CGwxZgib54b5hNyPlV+97kae4hsRvn7NmH1yjSQFaM20Gu6eA9Q:TviDclyGwxq5bfNc7TjSXMVE

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2996-0-0x0000000000400000-0x000000000044F000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2996	11f0e9c5e823f34c03ae46220068f29b.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3064	2996	11f0e9c5e823f34c03ae46220068f29b.exe	17
PID 2996 wrote to memory of 3064	2996	11f0e9c5e823f34c03ae46220068f29b.exe	17
PID 2996 wrote to memory of 3064	2996	11f0e9c5e823f34c03ae46220068f29b.exe	17
PID 2996 wrote to memory of 3064	2996	11f0e9c5e823f34c03ae46220068f29b.exe	17
PID 2996 wrote to memory of 3064	2996	11f0e9c5e823f34c03ae46220068f29b.exe	17
PID 2996 wrote to memory of 3064	2996	11f0e9c5e823f34c03ae46220068f29b.exe	17
PID 2996 wrote to memory of 3064	2996	11f0e9c5e823f34c03ae46220068f29b.exe	17

memory/2996-3-0x00000000002A0000-0x00000000002B4000-memory.dmp

Filesize
80KB

Download
memory/2996-6-0x00000000002A0000-0x00000000002B4000-memory.dmp

Filesize
80KB

Download
memory/2996-2-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/2996-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2996-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3064-8-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/3064-7-0x0000000000580000-0x0000000000588000-memory.dmp

Filesize
32KB

Download
memory/3064-5-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/3064-4-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/3064-11-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download