e2b39c4e384688ce8cc804eb468ae2829c814b2145f7fa1fc8f313233bd2cadd

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 03:13

Target

4f535ed5f81acb6563ece83b76555333.exe
Size

373KB
MD5

4f535ed5f81acb6563ece83b76555333
SHA1

3491e33820e1f856b4d12ed0f9b4167d2df15432
SHA256

e2b39c4e384688ce8cc804eb468ae2829c814b2145f7fa1fc8f313233bd2cadd
SHA512

ed879a81e7f3d95fa5469b02f14c37e7decae55807796de82a5e183a213340b738826a6c5005f63653912d9dddb314c33fe4d924a479adf6eac58f7a9067aa9c
SSDEEP

6144:O71s7MqrWsve48edpIynD5bZ1XmmV9jwQ1E++yDqDCphnF1cACTfgjdBi:zWi8eQeZ1XmM9j519DXF1kfgjdBi

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1832-0-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral2/memory/1832-4-0x0000000000400000-0x00000000004E2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1616	1832	4f535ed5f81acb6563ece83b76555333.exe	91
PID 1832 wrote to memory of 1616	1832	4f535ed5f81acb6563ece83b76555333.exe	91
PID 1832 wrote to memory of 1616	1832	4f535ed5f81acb6563ece83b76555333.exe	91

C:\Users\Admin\AppData\Local\Temp\4f535ed5f81acb6563ece83b76555333.exe
"C:\Users\Admin\AppData\Local\Temp\4f535ed5f81acb6563ece83b76555333.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\4f535ed5f81acb6563ece83b76555333.bat
  2⤵
  PID:1616

C:\Users\Admin\AppData\Local\Temp\4f535ed5f81acb6563ece83b76555333.bat

Filesize
254B

MD5
dce06a726d835d55c36dd3d77bb4b1ed

SHA1
23a2abf89befd3c6b2735980034e8634929ffcf8

SHA256
9e887e729ce3f5be2c4114742415dde49459f7f370599f4d3398217ee6fa17b0

SHA512
fbdfe8b3d0128c891aa8335aa62e628b1f08cc351e312248758ff6e91658dcf97a3faecc601bf7409b594b505b0a61388ee082235961aacb44b7524a61a08a57

Download Submit
memory/1832-0-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1832-1-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/1832-4-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download