dca537ed30679f4c77c3233802315d6f60b8ba86269fe5bc88dca5785e500857

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:55

Target

6c706ab45cf92626b5993b8d133e8751.exe
Size

83KB
MD5

6c706ab45cf92626b5993b8d133e8751
SHA1

3fcc213f8e54762dc4c835316cd7d41987bb2193
SHA256

dca537ed30679f4c77c3233802315d6f60b8ba86269fe5bc88dca5785e500857
SHA512

18b36c1618d2e64155afc774e7b2e0caec16b579bb616008513a68c50a5c05b648b161fe46b1c0078846785dddbb28d7c70763d09d6b9878af1c6a9ad017f7fc
SSDEEP

1536:IsXmjg8ieOKL2cHrlzwYtzJgvhYIjfYC3Es2diHFmTV2THt4:KIeOkrlzXQZHQ2a

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1052-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1052-1-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\ywphh	6c706ab45cf92626b5993b8d133e8751.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\ywphh	6c706ab45cf92626b5993b8d133e8751.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	6c706ab45cf92626b5993b8d133e8751.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	6c706ab45cf92626b5993b8d133e8751.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	6c706ab45cf92626b5993b8d133e8751.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\ywphh\\command	6c706ab45cf92626b5993b8d133e8751.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	6c706ab45cf92626b5993b8d133e8751.exe

C:\Users\Admin\AppData\Local\Temp\6c706ab45cf92626b5993b8d133e8751.exe
"C:\Users\Admin\AppData\Local\Temp\6c706ab45cf92626b5993b8d133e8751.exe"
1⤵
- Modifies registry class
PID:1052

memory/1052-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1052-1-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download