1fd73ba58f06fb6faa372bf7e403ddb23d80118a4c5cbe147b226132d7405827

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:41

Target

0c0021e7077d1712550f06d923f1fd5f.exe
Size

1.5MB
MD5

0c0021e7077d1712550f06d923f1fd5f
SHA1

8c7b36962eac6e0b8df087a720d3d259bf618d4f
SHA256

1fd73ba58f06fb6faa372bf7e403ddb23d80118a4c5cbe147b226132d7405827
SHA512

cfd0a672d7dd38244d7a9a98aeb243781c2678b4566d9f64c4b48129cb10f424a365e5a0c398a087781947f97135e31f84328cd452a8450f75470de9ccf2fd62
SSDEEP

24576:6C3MKDDh2/fciYgLafBuqUMnAEQd1uxlvAkFddtgzqtILNOYsthH/NUH663AUM2S:P8KDDhi+fBuqUMnAEQqPAEdhWd2H/NU5

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2092	0c0021e7077d1712550f06d923f1fd5f.exe

Executes dropped EXE 1 IoCs

pid	Process
2092	0c0021e7077d1712550f06d923f1fd5f.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3312-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/memory/2092-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000400000001e96f-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3312	0c0021e7077d1712550f06d923f1fd5f.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3312	0c0021e7077d1712550f06d923f1fd5f.exe
2092	0c0021e7077d1712550f06d923f1fd5f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 2092	3312	0c0021e7077d1712550f06d923f1fd5f.exe	89
PID 3312 wrote to memory of 2092	3312	0c0021e7077d1712550f06d923f1fd5f.exe	89
PID 3312 wrote to memory of 2092	3312	0c0021e7077d1712550f06d923f1fd5f.exe	89

C:\Users\Admin\AppData\Local\Temp\0c0021e7077d1712550f06d923f1fd5f.exe

Filesize
1.4MB

MD5
d2f1037142f8d0f5de4d366d7cc01305

SHA1
34ac793d2589b3379b8392327471501d66eaaac9

SHA256
b0462147dccc0f8cdb4c600ed642bd4ef0f30b30db8550c765dddbe39a4d63a4

SHA512
c1fd26302f6151cf370186bc0e2b5726430c07479293ad04d05ed22c3ff97d640479c0069057ba2b58ff45db99022f853146784bb82ee5495507c0854be7a152

Download Submit
memory/2092-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2092-15-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/2092-21-0x00000000056D0000-0x00000000058FA000-memory.dmp

Filesize
2.2MB

Download
memory/2092-20-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2092-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2092-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3312-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3312-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3312-1-0x0000000001D50000-0x0000000001E83000-memory.dmp

Filesize
1.2MB

Download
memory/3312-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download