6da42fb22d7b8b7817dcaf3ccccb5e616c19788b0d85dcb94d8a1eeba4a43951

Analysis

max time kernel
148s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 02:14

Target

4bf55eb7e88d799e8d05fb3ac5effd5d.exe
Size

235KB
MD5

4bf55eb7e88d799e8d05fb3ac5effd5d
SHA1

d41b6381b09362338b351badb863c7156fced885
SHA256

6da42fb22d7b8b7817dcaf3ccccb5e616c19788b0d85dcb94d8a1eeba4a43951
SHA512

c1db670a78c5670878d4035dccbdbbef8b66b2d67d819e62cafc428b57a1105dd0d5c533610d1584da45f0cb2e18f8964972639d7bf9134c1d666aae1c5f7560
SSDEEP

3072:do3dh2lpR/n2gft+UN1OPbfj8IaDS29y4+Eiq8uhzXZvOAZ3dHX/dgW3Gs7vBAAO:O3KlT2WoV5b285uTDNd3ehsle

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1900-0-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1900	4bf55eb7e88d799e8d05fb3ac5effd5d.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2384	1900	4bf55eb7e88d799e8d05fb3ac5effd5d.exe	17
PID 1900 wrote to memory of 2384	1900	4bf55eb7e88d799e8d05fb3ac5effd5d.exe	17
PID 1900 wrote to memory of 2384	1900	4bf55eb7e88d799e8d05fb3ac5effd5d.exe	17
PID 1900 wrote to memory of 2384	1900	4bf55eb7e88d799e8d05fb3ac5effd5d.exe	17
PID 1900 wrote to memory of 2384	1900	4bf55eb7e88d799e8d05fb3ac5effd5d.exe	17
PID 1900 wrote to memory of 2384	1900	4bf55eb7e88d799e8d05fb3ac5effd5d.exe	17
PID 1900 wrote to memory of 2384	1900	4bf55eb7e88d799e8d05fb3ac5effd5d.exe	17

memory/1900-3-0x00000000001C0000-0x00000000001EA000-memory.dmp

Filesize
168KB

Download
memory/1900-6-0x00000000003A0000-0x00000000003B4000-memory.dmp

Filesize
80KB

Download
memory/1900-2-0x00000000003A0000-0x00000000003B4000-memory.dmp

Filesize
80KB

Download
memory/1900-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1900-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2384-8-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2384-7-0x0000000000650000-0x0000000000658000-memory.dmp

Filesize
32KB

Download
memory/2384-5-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2384-4-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2384-11-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download