3822879443d426175b1b1af3eac1681ef4aab78217a59c9b0ba41882082d4c75

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:41

Target

0ed5b569e1b126eb54b306aac1bfc53b.exe
Size

2.7MB
MD5

0ed5b569e1b126eb54b306aac1bfc53b
SHA1

1d2ad544c5b293393df781e686370547057e89cb
SHA256

3822879443d426175b1b1af3eac1681ef4aab78217a59c9b0ba41882082d4c75
SHA512

6c3181b45033b2ee600a69596bcd6d82b9fbd638604041494325a6866eeb3147e6921df7a72baa46c122dce5a860b9e21b6038ae209d8b44054ae962f22e7934
SSDEEP

49152:6AIMMRQ8/H4DAIZruRIg+5ZnojTfoLfdvVjjAiOCm/+cp22MR6AHf:m/RKDDsRq5ZnojexqDCm/+hXHf

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2800	0ed5b569e1b126eb54b306aac1bfc53b.exe

Executes dropped EXE 1 IoCs

pid	Process
2800	0ed5b569e1b126eb54b306aac1bfc53b.exe

Loads dropped DLL 1 IoCs

pid	Process
1736	0ed5b569e1b126eb54b306aac1bfc53b.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1736-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1736	0ed5b569e1b126eb54b306aac1bfc53b.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1736	0ed5b569e1b126eb54b306aac1bfc53b.exe
2800	0ed5b569e1b126eb54b306aac1bfc53b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2800	1736	0ed5b569e1b126eb54b306aac1bfc53b.exe	15
PID 1736 wrote to memory of 2800	1736	0ed5b569e1b126eb54b306aac1bfc53b.exe	15
PID 1736 wrote to memory of 2800	1736	0ed5b569e1b126eb54b306aac1bfc53b.exe	15
PID 1736 wrote to memory of 2800	1736	0ed5b569e1b126eb54b306aac1bfc53b.exe	15

memory/1736-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1736-2-0x0000000000250000-0x0000000000383000-memory.dmp

Filesize
1.2MB

Download
memory/1736-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1736-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1736-15-0x0000000003840000-0x0000000003D2F000-memory.dmp

Filesize
4.9MB

Download
memory/1736-31-0x0000000003840000-0x0000000003D2F000-memory.dmp

Filesize
4.9MB

Download
memory/2800-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2800-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2800-25-0x0000000003570000-0x000000000379A000-memory.dmp

Filesize
2.2MB

Download
memory/2800-20-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/2800-18-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2800-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download