0c3b80cd7bec1494f0037af8e8eafa5114960440b1b7e984ebad839b144f4768

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 08:33

Target

1382bddb8d6dc7d3e6cb047855c0618b.exe
Size

518KB
MD5

1382bddb8d6dc7d3e6cb047855c0618b
SHA1

94a097eb68185666856fb9dd43150921605c9283
SHA256

0c3b80cd7bec1494f0037af8e8eafa5114960440b1b7e984ebad839b144f4768
SHA512

3471b7ecaf1a8b592d8df2e8706ddd38d3f15d51d9e61f2252aa06a591e4ad9e650ecd91777863716027232ac769d8ac4d350d3c7d75abe4a11060bea42eff33
SSDEEP

12288:s2xx1R2vSMQO3Q/YxXKee5HjzkW74TcIr+Y5p/j8HLPvjHev:s2vMQr/YWB54TjqApLGf

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1480-0-0x0000000000400000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1480-4-0x0000000000400000-0x0000000000510000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vccr.zip	1382bddb8d6dc7d3e6cb047855c0618b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 3216	1480	1382bddb8d6dc7d3e6cb047855c0618b.exe	98
PID 1480 wrote to memory of 3216	1480	1382bddb8d6dc7d3e6cb047855c0618b.exe	98
PID 1480 wrote to memory of 3216	1480	1382bddb8d6dc7d3e6cb047855c0618b.exe	98

C:\Users\Admin\AppData\Local\Temp\1382bddb8d6dc7d3e6cb047855c0618b.exe
"C:\Users\Admin\AppData\Local\Temp\1382bddb8d6dc7d3e6cb047855c0618b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\30200.bat
  2⤵
  PID:3216

memory/1480-0-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/1480-1-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/1480-4-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download