c12f8cd56f29ade349bf82c638dc25bb8d474cc154cddfd2983487571dcd8a87

Analysis

max time kernel
197s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:53

Target

0c393dc5709bb3837fe80f10f3a6ae2c.exe
Size

228KB
MD5

0c393dc5709bb3837fe80f10f3a6ae2c
SHA1

8755cefde1eace6934ff2e4c3b6d55a2a59c6705
SHA256

c12f8cd56f29ade349bf82c638dc25bb8d474cc154cddfd2983487571dcd8a87
SHA512

7cc3ebacb0b6a704603c45c0648c365fec02d50bf4152e89184b840a7997803622c8df4f494c7bee52693cfc2ce7376ef6581a8aee68c0688e3f41c357488791
SSDEEP

3072:blN9RkkkkkkTLJ0YufKOpHuMpBlN9RkkkkkkTLJ0YufKOpHuMppM:5dkkkkkkZpOpHR5dkkkkkkZpOpHRo

Score

7^/10

upx

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/856-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/856-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/856-3-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/856-4-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/856-8-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/files/0x000600000002321e-11.dat	upx
behavioral2/memory/856-24-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/856-26-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/856-27-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/856-28-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/856-29-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/856-30-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\win32dc\UT2004 trainer.exe	0c393dc5709bb3837fe80f10f3a6ae2c.exe
File created	C:\Windows\win32dc\Sims 2_patch.exe	0c393dc5709bb3837fe80f10f3a6ae2c.exe
File created	C:\Windows\win32dc\Half-Life 2 patch.exe	0c393dc5709bb3837fe80f10f3a6ae2c.exe
File created	C:\Windows\win32dc\Quake3(cheat).exe	0c393dc5709bb3837fe80f10f3a6ae2c.exe
File opened for modification	C:\Windows\win32dc\Quake3(cheat).exe	0c393dc5709bb3837fe80f10f3a6ae2c.exe
File created	C:\Windows\win32dc\UT2004 + cheat.exe	0c393dc5709bb3837fe80f10f3a6ae2c.exe
File opened for modification	C:\Windows\win32dc\Sims 2_patch.exe	0c393dc5709bb3837fe80f10f3a6ae2c.exe
File created	C:\Windows\win32dc\Half-Life 2 crack.exe	0c393dc5709bb3837fe80f10f3a6ae2c.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 patch.exe	0c393dc5709bb3837fe80f10f3a6ae2c.exe
File created	C:\Windows\win32dc\BattleField 1942 hack.exe	0c393dc5709bb3837fe80f10f3a6ae2c.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942 hack.exe	0c393dc5709bb3837fe80f10f3a6ae2c.exe
File created	C:\Windows\win32dc\UT2004(patch).exe	0c393dc5709bb3837fe80f10f3a6ae2c.exe
File created	C:\Windows\win32dc\Quake3(serial).exe	0c393dc5709bb3837fe80f10f3a6ae2c.exe
File opened for modification	C:\Windows\win32dc\UT2004 trainer.exe	0c393dc5709bb3837fe80f10f3a6ae2c.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 crack.exe	0c393dc5709bb3837fe80f10f3a6ae2c.exe

C:\Users\Admin\AppData\Local\Temp\0c393dc5709bb3837fe80f10f3a6ae2c.exe
"C:\Users\Admin\AppData\Local\Temp\0c393dc5709bb3837fe80f10f3a6ae2c.exe"
1⤵
- Drops file in Windows directory
PID:856

C:\Windows\win32dc\UT2004(patch).exe

Filesize
228KB

MD5
0c393dc5709bb3837fe80f10f3a6ae2c

SHA1
8755cefde1eace6934ff2e4c3b6d55a2a59c6705

SHA256
c12f8cd56f29ade349bf82c638dc25bb8d474cc154cddfd2983487571dcd8a87

SHA512
7cc3ebacb0b6a704603c45c0648c365fec02d50bf4152e89184b840a7997803622c8df4f494c7bee52693cfc2ce7376ef6581a8aee68c0688e3f41c357488791

Download Submit
memory/856-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/856-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/856-3-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/856-4-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/856-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/856-24-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/856-26-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/856-27-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/856-28-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/856-29-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/856-30-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download