d6b25771183dbf9f2597d4261db4cd1fb7831785cb720dbc14c832489de245ce

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:33

Target

285392875d65770426ae4855940d4292.exe
Size

784KB
MD5

285392875d65770426ae4855940d4292
SHA1

ae1c051ca9e78d84abf90d36873796b152eddb46
SHA256

d6b25771183dbf9f2597d4261db4cd1fb7831785cb720dbc14c832489de245ce
SHA512

3f71c80d91116eda23cc7d6980aba93bbd8e56a1ced4c0c1d5cafd1ffc04e1ae8d7b9e67334d2a0258c698a8b58dfb3153f6e78f8f08f99dd7004f1e3482a027
SSDEEP

12288:wZPy043VnNjUaCyDCqK1tSe1Iyc0MhfLH+pBYFBgw6CabgMNoh8Ht2hSPfFyhtNW:pXjOyD3K1tSgQ+vguCcNohWIwNyhzv

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
3028	285392875d65770426ae4855940d4292.exe

Executes dropped EXE 1 IoCs

pid	Process
3028	285392875d65770426ae4855940d4292.exe

Loads dropped DLL 1 IoCs

pid	Process
1276	285392875d65770426ae4855940d4292.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1276-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x000a0000000139b6-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1276	285392875d65770426ae4855940d4292.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1276	285392875d65770426ae4855940d4292.exe
3028	285392875d65770426ae4855940d4292.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 3028	1276	285392875d65770426ae4855940d4292.exe	14
PID 1276 wrote to memory of 3028	1276	285392875d65770426ae4855940d4292.exe	14
PID 1276 wrote to memory of 3028	1276	285392875d65770426ae4855940d4292.exe	14
PID 1276 wrote to memory of 3028	1276	285392875d65770426ae4855940d4292.exe	14

\Users\Admin\AppData\Local\Temp\285392875d65770426ae4855940d4292.exe

Filesize
92KB

MD5
5b582dcd41ec941f4ba3a27eac83f163

SHA1
f1d61461cd1eb5949aa6bc4442068f3fa0ff486a

SHA256
dec7bace0ef725b5723554b9f09b403a99ce79f6fe0fa0c4ff0f810e5f73ef58

SHA512
e66c08866d5fa1a77eedd1315a126a395dd6ca3896c1d79f93e5c7f307ee9b308da7c40d0e8cbbc97edd6c12b1468b0e3e3ac05443804c338b09e1dde61fd350

Download Submit
memory/1276-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/1276-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1276-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1276-3-0x0000000000300000-0x00000000003C4000-memory.dmp

Filesize
784KB

Download
memory/3028-16-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3028-18-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3028-17-0x00000000018B0000-0x0000000001974000-memory.dmp

Filesize
784KB

Download
memory/3028-25-0x0000000003220000-0x00000000033B3000-memory.dmp

Filesize
1.6MB

Download
memory/3028-33-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3028-23-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download