bcf31f5be37e227e0b025b42d47164381dd0293db7ab5b2b3d142423a8166668 | Triage

Analysis

max time kernel
88s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 22:50

Sharing

Report Analysis Logs

General

Target

415517a4fe493b305270ca1e8995f26d.exe
Size

27KB
MD5

415517a4fe493b305270ca1e8995f26d
SHA1

a817889149843ca1d5d5290d81455c61b8c6d61a
SHA256

bcf31f5be37e227e0b025b42d47164381dd0293db7ab5b2b3d142423a8166668
SHA512

2ef4e6385003da6c0ac81d4890819c4b941c5caafdb72a07981f4e641efb594d088938c53fa6090504a2bbfc05fb48f3f12d316a55d4129c2e8aad69adc8db30
SSDEEP

768:6fSaesE55AOd0hxOes67GheEasAssVSo:6k35Ao0ieCasAssVSo

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4480-0-0x0000000013140000-0x0000000013158000-memory.dmp	upx
behavioral2/memory/4480-1-0x0000000013140000-0x0000000013158000-memory.dmp	upx

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 2640	4480	415517a4fe493b305270ca1e8995f26d.exe	9

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2640
- C:\Users\Admin\AppData\Local\Temp\415517a4fe493b305270ca1e8995f26d.exe
  "C:\Users\Admin\AppData\Local\Temp\415517a4fe493b305270ca1e8995f26d.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4480-0-0x0000000013140000-0x0000000013158000-memory.dmp

Filesize
96KB

Download
memory/4480-1-0x0000000013140000-0x0000000013158000-memory.dmp

Filesize
96KB

Download