cf239f78ac1b7e72e301dd8f0482866e8ff664bc4c9ad7f78648b466dbeef9ff

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 15:05

Target

77bc02e8c565cee1288a6f918711136c.exe
Size

28KB
MD5

77bc02e8c565cee1288a6f918711136c
SHA1

50283f269435ed351cd9a04e605ed607617dc744
SHA256

cf239f78ac1b7e72e301dd8f0482866e8ff664bc4c9ad7f78648b466dbeef9ff
SHA512

4b3cb9347d909c2cee960d4726a4800f556f9ae22c610a15fb86febe69281b7c835376e551965fc6d55fbed6a0c9ce0ba5761d62077e4bf78f19106919da344c
SSDEEP

768:5CUb3foaqTPawJG1VdPdEPcurxbjAmKmrV:QUL9qba+GvdPdEUWxbkmZV

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2196-0-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/2196-4-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/3552-5-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/3552-8-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost.exe:exe.exe	77bc02e8c565cee1288a6f918711136c.exe
File created	C:\Windows\SysWOW64\icf.exe	77bc02e8c565cee1288a6f918711136c.exe
File opened for modification	C:\Windows\SysWOW64\icf.exe	77bc02e8c565cee1288a6f918711136c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2196 set thread context of 3552	2196	77bc02e8c565cee1288a6f918711136c.exe	17

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 3552	2196	77bc02e8c565cee1288a6f918711136c.exe	17
PID 2196 wrote to memory of 3552	2196	77bc02e8c565cee1288a6f918711136c.exe	17
PID 2196 wrote to memory of 3552	2196	77bc02e8c565cee1288a6f918711136c.exe	17
PID 2196 wrote to memory of 3552	2196	77bc02e8c565cee1288a6f918711136c.exe	17
PID 2196 wrote to memory of 2268	2196	77bc02e8c565cee1288a6f918711136c.exe	16
PID 2196 wrote to memory of 2268	2196	77bc02e8c565cee1288a6f918711136c.exe	16
PID 2196 wrote to memory of 2268	2196	77bc02e8c565cee1288a6f918711136c.exe	16

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\10223619.bat
1⤵
PID:2268

C:\Users\Admin\AppData\Local\Temp\10223619.bat

Filesize
238B

MD5
26c4818850bc5e64f37b207acd8960e5

SHA1
475dc63ae801739954978de00ab75f0548382233

SHA256
49b5135fda666d1901c7b3f18daae517bda5a26abd782058ab7da9cdb6b9dd88

SHA512
d4b8c5d83bb22fbee6da5a4eee62e4576af3c30bfc8894fc213004a1cefaa3e1bcc2323b88b07ddacbeb1e2ff1b1cec33f1e2e1f1229b1d2c3d4160e6ddd1e87

Download Submit
memory/2196-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2196-4-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3552-5-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3552-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download