f632b9cc4fe7a9087001bc1abe7df0aac8dcc7ede937e6edd6c26a40f886e32e

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:52

Target

0f1fde4db0ef73ae222cbe6a3641e64d.exe
Size

87KB
MD5

0f1fde4db0ef73ae222cbe6a3641e64d
SHA1

5a8d6539b568524605aff55a51226fb2f824fd6e
SHA256

f632b9cc4fe7a9087001bc1abe7df0aac8dcc7ede937e6edd6c26a40f886e32e
SHA512

c7537da82eb7f5eaeb9a065d8d14caa0fcd2eb1fc929b7a0543336eb8a7322df9105b0d7ea0583bf3d19caffa5f1f5d8c78fd7c562804df256a2a65c713ad7e5
SSDEEP

1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhMBqKG:blN9RkkkkkkTLBzG

Score

7^/10

upx

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2076-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2076-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/files/0x0007000000015d95-6.dat	upx
behavioral1/memory/2076-16-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2076-17-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2076-18-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2076-19-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2076-20-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2076-21-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2076-22-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2076-23-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2076-24-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2076-25-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\win32dc\UT2004(codes).exe	0f1fde4db0ef73ae222cbe6a3641e64d.exe
File created	C:\Windows\win32dc\Quake3(serial).exe	0f1fde4db0ef73ae222cbe6a3641e64d.exe
File created	C:\Windows\win32dc\Half-Life 2_patch.exe	0f1fde4db0ef73ae222cbe6a3641e64d.exe
File created	C:\Windows\win32dc\DAoC(serial).exe	0f1fde4db0ef73ae222cbe6a3641e64d.exe
File created	C:\Windows\win32dc\UT2004_crack.exe	0f1fde4db0ef73ae222cbe6a3641e64d.exe
File opened for modification	C:\Windows\win32dc\UT2004_crack.exe	0f1fde4db0ef73ae222cbe6a3641e64d.exe
File opened for modification	C:\Windows\win32dc\UT2004(codes).exe	0f1fde4db0ef73ae222cbe6a3641e64d.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 nocd.exe	0f1fde4db0ef73ae222cbe6a3641e64d.exe
File created	C:\Windows\win32dc\BattleField 1942_cheat.exe	0f1fde4db0ef73ae222cbe6a3641e64d.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2_patch.exe	0f1fde4db0ef73ae222cbe6a3641e64d.exe
File created	C:\Windows\win32dc\Half-Life 2(serial).exe	0f1fde4db0ef73ae222cbe6a3641e64d.exe
File created	C:\Windows\win32dc\Half-Life 2 nocd.exe	0f1fde4db0ef73ae222cbe6a3641e64d.exe
File created	C:\Windows\win32dc\Quake3 + codes.exe	0f1fde4db0ef73ae222cbe6a3641e64d.exe
File created	C:\Windows\win32dc\Silent Hill 4 + cdfix.exe	0f1fde4db0ef73ae222cbe6a3641e64d.exe

C:\Users\Admin\AppData\Local\Temp\0f1fde4db0ef73ae222cbe6a3641e64d.exe
"C:\Users\Admin\AppData\Local\Temp\0f1fde4db0ef73ae222cbe6a3641e64d.exe"
1⤵
- Drops file in Windows directory
PID:2076

C:\Windows\win32dc\Quake3 + codes.exe

Filesize
87KB

MD5
0f1fde4db0ef73ae222cbe6a3641e64d

SHA1
5a8d6539b568524605aff55a51226fb2f824fd6e

SHA256
f632b9cc4fe7a9087001bc1abe7df0aac8dcc7ede937e6edd6c26a40f886e32e

SHA512
c7537da82eb7f5eaeb9a065d8d14caa0fcd2eb1fc929b7a0543336eb8a7322df9105b0d7ea0583bf3d19caffa5f1f5d8c78fd7c562804df256a2a65c713ad7e5

Download Submit
memory/2076-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2076-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2076-16-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2076-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2076-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2076-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2076-20-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2076-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2076-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2076-23-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2076-24-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2076-25-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download