1583f826540819b2b44e947ba50f55a453ba8e8593d713c123b147a64c5e0f56

Analysis

max time kernel
0s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 11:51

Target

1c22d18339f7472d8d1850f4c219e6e6.exe
Size

227KB
MD5

1c22d18339f7472d8d1850f4c219e6e6
SHA1

a3fc89bac4e4c61395a18452f610fb727b00810f
SHA256

1583f826540819b2b44e947ba50f55a453ba8e8593d713c123b147a64c5e0f56
SHA512

3cfe8029bd3b5aa007285b81472ae7030da6bc0f5a675df742dca69bbd7f3004737b15217b323bc27b8df5df2f21ef316133232deea7e2cc5f6f60426811f053
SSDEEP

6144:Od/oKyhlMI4s9hs9gqt8sHE8Ywe3Mox+pqoSSV11:OJhlsnstn+LroSSl

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2468-45-0x00000000003D0000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2188-0-0x00000000003D0000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2188-102-0x00000000003D0000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2468-103-0x00000000003D0000-0x000000000046E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2572	2188	1c22d18339f7472d8d1850f4c219e6e6.exe	18
PID 2188 wrote to memory of 2572	2188	1c22d18339f7472d8d1850f4c219e6e6.exe	18
PID 2188 wrote to memory of 2572	2188	1c22d18339f7472d8d1850f4c219e6e6.exe	18
PID 2188 wrote to memory of 2572	2188	1c22d18339f7472d8d1850f4c219e6e6.exe	18

C:\Windows\SysWOW64\cscript.exe
cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs
1⤵
PID:2572

C:\Users\Admin\AppData\Local\Temp\1c22d18339f7472d8d1850f4c219e6e6.exe
"C:\Users\Admin\AppData\Local\Temp\1c22d18339f7472d8d1850f4c219e6e6.exe" /asService /logPath "C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log"
1⤵
PID:2468

C:\Users\Admin\AppData\Local\Temp\1c22d18339f7472d8d1850f4c219e6e6.exe
"C:\Users\Admin\AppData\Local\Temp\1c22d18339f7472d8d1850f4c219e6e6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188

memory/2188-44-0x0000000003AB0000-0x0000000003B4E000-memory.dmp

Filesize
632KB

Download
memory/2188-0-0x00000000003D0000-0x000000000046E000-memory.dmp

Filesize
632KB

Download
memory/2188-102-0x00000000003D0000-0x000000000046E000-memory.dmp

Filesize
632KB

Download
memory/2468-45-0x00000000003D0000-0x000000000046E000-memory.dmp

Filesize
632KB

Download
memory/2468-103-0x00000000003D0000-0x000000000046E000-memory.dmp

Filesize
632KB

Download