98c86b82ad75a640370b5a286899adffc67418f3cde498b1df74c7da8615aa55

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:27

Target

6ac1fa65989e478e1158067dd65530b5.exe
Size

948KB
MD5

6ac1fa65989e478e1158067dd65530b5
SHA1

6c744f6d6e542e9a6f754889e759590f8b3fabb4
SHA256

98c86b82ad75a640370b5a286899adffc67418f3cde498b1df74c7da8615aa55
SHA512

be58fddc8e7f6a744ca181c38ede993827b1639b33584fa13e694f272fcc7731df33f554e5c1aa305ef665559a53e49274e4c46199ad4ffd660fc98f33e62f3d
SSDEEP

24576:9tR3X2PDQMNuPLY6Q0dmbkHdn2DWvlTC3sVJW7s7NI:9tRH/5OkfW7s7NI

Score

8^/10

upx

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\TXPlatformm.exe	6ac1fa65989e478e1158067dd65530b5.exe
File created	C:\Windows\SysWOW64\drivers\TXPlatformm.exe	6ac1fa65989e478e1158067dd65530b5.exe

Deletes itself 1 IoCs

pid	Process
2204	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2852	TXPlatformm.exe
3044	6ac1fa65989e478e1158067dd65530b5.exe

Loads dropped DLL 3 IoCs

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2852-21-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/2360-20-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/files/0x000a000000015f7a-12.dat	upx
behavioral1/files/0x000a000000015f7a-10.dat	upx
behavioral1/memory/2360-0-0x0000000000400000-0x000000000044C000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2204	2360	6ac1fa65989e478e1158067dd65530b5.exe	16
PID 2360 wrote to memory of 2204	2360	6ac1fa65989e478e1158067dd65530b5.exe	16
PID 2360 wrote to memory of 2204	2360	6ac1fa65989e478e1158067dd65530b5.exe	16
PID 2360 wrote to memory of 2204	2360	6ac1fa65989e478e1158067dd65530b5.exe	16
PID 2360 wrote to memory of 2852	2360	6ac1fa65989e478e1158067dd65530b5.exe	18
PID 2360 wrote to memory of 2852	2360	6ac1fa65989e478e1158067dd65530b5.exe	18
PID 2360 wrote to memory of 2852	2360	6ac1fa65989e478e1158067dd65530b5.exe	18
PID 2360 wrote to memory of 2852	2360	6ac1fa65989e478e1158067dd65530b5.exe	18
PID 2204 wrote to memory of 3044	2204	cmd.exe	17
PID 2204 wrote to memory of 3044	2204	cmd.exe	17
PID 2204 wrote to memory of 3044	2204	cmd.exe	17
PID 2204 wrote to memory of 3044	2204	cmd.exe	17

C:\Users\Admin\AppData\Local\Temp\52$$.bat

Filesize
485B

MD5
05f963ee30774c47505b60dafc22c19b

SHA1
624e1dfcb44ebf6f40d3abe1ef57c1e877424924

SHA256
de98ce991b6a034c44c6a8fc3cd497e86cfc2122bd5005f7a46e4ae3dbde1740

SHA512
3bc2f0e92e20a6f71175aae41ae57c21a94d491b4c16055a498a85899b2bb578e8a3dec017dbaa6ae3dd0049c96030a2d53186ba5f977575f0cc128dcbf2f227

Download Submit
\Windows\SysWOW64\drivers\TXPlatformm.exe

Filesize
298KB

MD5
4b699badb6b222de32f6944c424be3c8

SHA1
671e0a320a6345c65923bf66cc54c402948b2bce

SHA256
c5ec2700d3e5ce4d67e80fe0aae2a5cb1179d926e72dc536127cbc7b912eda4d

SHA512
602cfd0275aeaf5538cfc79b1621079eea48a9c0a2aad4cd27bc480d31a424f90d8990051dd44637ac60e417e315e0f34c212c6e9b09d1b50b5ed4d5b4f5ba54

Download Submit
memory/2360-18-0x0000000000220000-0x000000000026C000-memory.dmp

Filesize
304KB

Download
memory/2360-20-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2360-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2852-21-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download