eaa47b7774677b023ae0a53afd136fb9e3b39d60d68649db0d59f8e599d613c9

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:16

Target

1fb47bccf43b6bf050159bebc32257a6.exe
Size

10.6MB
MD5

1fb47bccf43b6bf050159bebc32257a6
SHA1

00168250b5241cb05b3a4f35355da4e9a891f4bc
SHA256

eaa47b7774677b023ae0a53afd136fb9e3b39d60d68649db0d59f8e599d613c9
SHA512

690f5e640919aafd9731f733fb49141255992ccdd29259f66c3c8105afbb0d3c46eb0b080d2ae173cf038b271683d9b21be78be1b322e0c6e9c2cee8160e4e1c
SSDEEP

196608:lBC1Wk2qGtyB/rnCeKaRz+wnXGtyB/rnC1tzBxbnBGtyB/rnCeKaRz+wnXGtyB/Y:HOWaGtyB/r3TRnGtyB/rwtzXBGtyB/rS

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2720	1fb47bccf43b6bf050159bebc32257a6.exe

Executes dropped EXE 1 IoCs

pid	Process
2720	1fb47bccf43b6bf050159bebc32257a6.exe

Loads dropped DLL 1 IoCs

pid	Process
2536	1fb47bccf43b6bf050159bebc32257a6.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2536-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000e000000012232-10.dat	upx
behavioral1/memory/2536-12-0x0000000004780000-0x0000000004C6F000-memory.dmp	upx
behavioral1/memory/2720-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2536	1fb47bccf43b6bf050159bebc32257a6.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2536	1fb47bccf43b6bf050159bebc32257a6.exe
2720	1fb47bccf43b6bf050159bebc32257a6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2720	2536	1fb47bccf43b6bf050159bebc32257a6.exe	28
PID 2536 wrote to memory of 2720	2536	1fb47bccf43b6bf050159bebc32257a6.exe	28
PID 2536 wrote to memory of 2720	2536	1fb47bccf43b6bf050159bebc32257a6.exe	28
PID 2536 wrote to memory of 2720	2536	1fb47bccf43b6bf050159bebc32257a6.exe	28

\Users\Admin\AppData\Local\Temp\1fb47bccf43b6bf050159bebc32257a6.exe

Filesize
10.6MB

MD5
0caf40c4c7d8bbe9e3cf34033be0705b

SHA1
ff871a9e13f6d9cf96c0142b91abc363773ac930

SHA256
2f4a3bf35215cca631c9934dc9136b61131758f438bda5a5503753a3dbe4a745

SHA512
ccf25392b9b5b5c8a9e8fc584b57e8cbd1034df79e000779b7e9b88d502884aa077603e5afb9c93e7817faa901c3ed1d9b319c47d87ddc10756709a02bc93168

Download Submit
memory/2536-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2536-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2536-2-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2536-12-0x0000000004780000-0x0000000004C6F000-memory.dmp

Filesize
4.9MB

Download
memory/2536-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2720-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2720-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2720-18-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2720-24-0x0000000003420000-0x000000000364A000-memory.dmp

Filesize
2.2MB

Download
memory/2720-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2720-31-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download