75fac37c7582234eb71ad2987c8d3080a91b23bf74169ad41ad02a1f3af798a5

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:56

Target

1519ab6e387baaedf946cfaa8703b66c.exe
Size

26KB
MD5

1519ab6e387baaedf946cfaa8703b66c
SHA1

af77594e10f4ad22d7bd240d25fb712ece8b6e45
SHA256

75fac37c7582234eb71ad2987c8d3080a91b23bf74169ad41ad02a1f3af798a5
SHA512

2d665c374b805e5356fa120bf602a14a422ec4708b98e9283ae41aca8a338d8158a2257c89fa2de8f270b0310c491fd9ce936cfee98decb027f89d80821a4f3d
SSDEEP

384:yHjJWUnmMJer2WieD2EIGJQtxNVrwR6AIg4uU2GuCClaVKUAfPnNPFN:qtLwr2WXIfLNWeuU2GLClaVKU4NP

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2804	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2232	1519ab6e387baaedf946cfaa8703b66c.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2232-0-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/2232-11-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2804	2232	1519ab6e387baaedf946cfaa8703b66c.exe	27
PID 2232 wrote to memory of 2804	2232	1519ab6e387baaedf946cfaa8703b66c.exe	27
PID 2232 wrote to memory of 2804	2232	1519ab6e387baaedf946cfaa8703b66c.exe	27
PID 2232 wrote to memory of 2804	2232	1519ab6e387baaedf946cfaa8703b66c.exe	27

C:\Users\Admin\AppData\Local\Temp\1519ab6e387baaedf946cfaa8703b66c.exe
"C:\Users\Admin\AppData\Local\Temp\1519ab6e387baaedf946cfaa8703b66c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cas.bat
  2⤵
  - Deletes itself
  PID:2804

C:\Users\Admin\AppData\Local\Temp\cas.bat

Filesize
190B

MD5
6530c258d8cd9c4be6508837b3e41fcb

SHA1
7ae0a2383aa7e238d045234f4e7a4fb8da8d9961

SHA256
c5717b8120f89e0549b1c246c6712744d77d9cb22a0679d235fa574d963eeb8c

SHA512
13d5569a3d0b8ec3b81f1c0cda259978ae335885fe756ff6c2c686df73d9ad6f53c9185c2cb4da9194f295126fab90213088b42866d70e7dda94b20c4dfc5a2a

Download Submit
\Users\Admin\AppData\Local\Temp\Immd32.dll

Filesize
52KB

MD5
edd3cc5c011c4fdf6b72156e163bdacf

SHA1
d809cb37ac6147a1006d3ebd7fa07bb8a33800d9

SHA256
a0931dbb1b9e14248a92517b496f7aadd70323eb4f4cf4eeb18e45f8b94e9075

SHA512
01fc2ee39d7b27c48b89a2cf213baa5919b68d82fbe9a4172a0cb1ed633e26b047820d501725aa3de069cf6e8ae798c732ff0f03abcce5e37c341d6912b453e4

Download Submit
memory/2232-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2232-11-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download