4f3391629abbaa12a12a95059962d86e45ab59b86f9e7bf8d5a33715615ac41d

Analysis

max time kernel
147s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 06:14

Target

2b615b11608b3d94be1a1b1454f83997.exe
Size

5.8MB
MD5

2b615b11608b3d94be1a1b1454f83997
SHA1

b542c7d66c74bc0d98c5e5134f1b8c04532c09ec
SHA256

4f3391629abbaa12a12a95059962d86e45ab59b86f9e7bf8d5a33715615ac41d
SHA512

7e2ef28dd7e48a004ad366af8c95f9811350b461963d182fd8a2a059ae581388ec9bf411c3a19bbdbb965290f16a5be7d178bfd5e42f5a3b741505d2a0888e17
SSDEEP

98304:mxHKjNm9TtUJYUyVGQZaXhP5a9UEI+eG9jAkbkR79D+cVItGQZaXhP5a9UEI+eG:mr9ZmynGhRaaCkN9qHGhRa

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
1948	2b615b11608b3d94be1a1b1454f83997.exe

Executes dropped EXE 1 IoCs

pid	Process
1948	2b615b11608b3d94be1a1b1454f83997.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1712-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/memory/1948-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000700000002304b-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1712	2b615b11608b3d94be1a1b1454f83997.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1712	2b615b11608b3d94be1a1b1454f83997.exe
1948	2b615b11608b3d94be1a1b1454f83997.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1948	1712	2b615b11608b3d94be1a1b1454f83997.exe	21
PID 1712 wrote to memory of 1948	1712	2b615b11608b3d94be1a1b1454f83997.exe	21
PID 1712 wrote to memory of 1948	1712	2b615b11608b3d94be1a1b1454f83997.exe	21

C:\Users\Admin\AppData\Local\Temp\2b615b11608b3d94be1a1b1454f83997.exe

Filesize
704KB

MD5
f48816592981335613dd478d410c10d4

SHA1
a18898791768e990cb049d96022fa45ad13470cc

SHA256
153342e77afdb28f969b7f653f5bf6b3f636196d40a9082bfb596120eafb7458

SHA512
311d8622946eab98102f39b56415d0aa1d1f917a69e1dbf1105338a35fc706bf306cc90de13dd4fc2016b95627501a8a41b03af80022e0d32e6beae453ae1adb

Download Submit
memory/1712-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1712-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1712-1-0x0000000001CA0000-0x0000000001DD3000-memory.dmp

Filesize
1.2MB

Download
memory/1712-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1948-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1948-15-0x0000000001BF0000-0x0000000001D23000-memory.dmp

Filesize
1.2MB

Download
memory/1948-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1948-20-0x00000000054F0000-0x000000000571A000-memory.dmp

Filesize
2.2MB

Download
memory/1948-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1948-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download