e159cde35e9e7101ce18d16081c3d5295946cc5f8096c0c475d24f3a141c528e

Analysis

max time kernel
88s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 13:18

Target

19be64629d344d40346307d7b77991ce.exe
Size

1.3MB
MD5

19be64629d344d40346307d7b77991ce
SHA1

93dc2c4f3a9f337bf893cd0151c6dfd21357d926
SHA256

e159cde35e9e7101ce18d16081c3d5295946cc5f8096c0c475d24f3a141c528e
SHA512

8c1613af2011454c8a1608cd21da08a0665ac81f69f9636e213acedcb31c3bc47c859325a1c60addfec0f4aa371b1dd286e560f97f1ce46ecc02c3a5a670afca
SSDEEP

24576:S639vlSmT4sqPbOd3NWlELEgRX2YCMlzhpPiVcsep7xb4t/cyBsIfmV6hNpU9/9j:b39dz/qsNWlELEI7lFpP+cvyHBh9fKRt

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
4464	19be64629d344d40346307d7b77991ce.exe

Executes dropped EXE 1 IoCs

pid	Process
4464	19be64629d344d40346307d7b77991ce.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3368-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral2/files/0x0006000000023217-11.dat	upx
behavioral2/memory/4464-13-0x0000000000400000-0x00000000008E7000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3368	19be64629d344d40346307d7b77991ce.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3368	19be64629d344d40346307d7b77991ce.exe
4464	19be64629d344d40346307d7b77991ce.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4464	3368	19be64629d344d40346307d7b77991ce.exe	32
PID 3368 wrote to memory of 4464	3368	19be64629d344d40346307d7b77991ce.exe	32
PID 3368 wrote to memory of 4464	3368	19be64629d344d40346307d7b77991ce.exe	32

C:\Users\Admin\AppData\Local\Temp\19be64629d344d40346307d7b77991ce.exe

Filesize
132KB

MD5
fd75c1151343ad794f7fbddd668ccd20

SHA1
2c09555082f482fd7b838e5f63f539781e756bcd

SHA256
7f798602e229f01125d8965745d1e5190260ee04b585a8b73902186a7a7892fc

SHA512
4dec8b9c55a2cd5d868b072a1698daebb50fef6f8633f7ad5a08c64c95b440282757014b6aa3ffd74b79292f4a6301bb95062b7b5a0e3443ebf180aa5c1fd975

Download Submit
memory/3368-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/3368-1-0x0000000001D40000-0x0000000001E71000-memory.dmp

Filesize
1.2MB

Download
memory/3368-2-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/3368-12-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/4464-13-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/4464-15-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/4464-20-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4464-21-0x0000000005660000-0x0000000005882000-memory.dmp

Filesize
2.1MB

Download
memory/4464-14-0x0000000001D70000-0x0000000001EA1000-memory.dmp

Filesize
1.2MB

Download
memory/4464-28-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download