d0d33d48d0369937d493a9a819eb4fd291e28d086898edb611c8a89be6a50dbd

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:08

Target

1e016653fa68e537d25dd42d232be241.exe
Size

2.9MB
MD5

1e016653fa68e537d25dd42d232be241
SHA1

f2229686782532433a63f5af92e76e223d800777
SHA256

d0d33d48d0369937d493a9a819eb4fd291e28d086898edb611c8a89be6a50dbd
SHA512

97a543c228f2f85b23bff7bc749a4ef62203cff50a25d97c3a12db8cd5b631bafe6f4b0ec528a3c58677ad6fb2f445264ee4f250dd4acdca2dcf19681db42fe9
SSDEEP

49152:Zgcsw0fk/4cT8JX6liYcU8QUQgN74NH5HUyNRcUsCVOzetdZJ:acsw0c/48cX68dUAQg4HBUCczzM3

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2384	1e016653fa68e537d25dd42d232be241.exe

Executes dropped EXE 1 IoCs

pid	Process
2384	1e016653fa68e537d25dd42d232be241.exe

Loads dropped DLL 1 IoCs

pid	Process
1940	1e016653fa68e537d25dd42d232be241.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1940-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1940	1e016653fa68e537d25dd42d232be241.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1940	1e016653fa68e537d25dd42d232be241.exe
2384	1e016653fa68e537d25dd42d232be241.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2384	1940	1e016653fa68e537d25dd42d232be241.exe	17
PID 1940 wrote to memory of 2384	1940	1e016653fa68e537d25dd42d232be241.exe	17
PID 1940 wrote to memory of 2384	1940	1e016653fa68e537d25dd42d232be241.exe	17
PID 1940 wrote to memory of 2384	1940	1e016653fa68e537d25dd42d232be241.exe	17

memory/1940-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1940-2-0x0000000000250000-0x0000000000383000-memory.dmp

Filesize
1.2MB

Download
memory/1940-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1940-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1940-15-0x0000000003A50000-0x0000000003F3F000-memory.dmp

Filesize
4.9MB

Download
memory/2384-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2384-18-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2384-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2384-25-0x0000000003430000-0x000000000365A000-memory.dmp

Filesize
2.2MB

Download
memory/2384-20-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2384-31-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download