c79155a70f2f1d1fa96c2f0545b9b744bfd35ef06a650bd1dc802d313c7386e1

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:05

Target

3923a737b6572245b708a12cb9834408.exe
Size

518KB
MD5

3923a737b6572245b708a12cb9834408
SHA1

ec472b81aab85f47c6e4f8308f4ce66e038705cd
SHA256

c79155a70f2f1d1fa96c2f0545b9b744bfd35ef06a650bd1dc802d313c7386e1
SHA512

c021549d5d150ff5fb1797975bbba78d5cbcbce14100618b690b33769cffc945da9445cf5a042164104dae77d34644c623b73dfbd7a621dd394813282ffd727a
SSDEEP

12288:R2xx1R2vSMQO3Q/YxXKee5Hj5kW74TcIr+Y5p/j8HLPvjHev:R2vMQr/YWBT4TjqApLGf

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2712	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1680-0-0x0000000000400000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1680-9-0x0000000000400000-0x0000000000510000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vccr.zip	3923a737b6572245b708a12cb9834408.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2712	1680	3923a737b6572245b708a12cb9834408.exe	28
PID 1680 wrote to memory of 2712	1680	3923a737b6572245b708a12cb9834408.exe	28
PID 1680 wrote to memory of 2712	1680	3923a737b6572245b708a12cb9834408.exe	28
PID 1680 wrote to memory of 2712	1680	3923a737b6572245b708a12cb9834408.exe	28

C:\Users\Admin\AppData\Local\Temp\3923a737b6572245b708a12cb9834408.exe
"C:\Users\Admin\AppData\Local\Temp\3923a737b6572245b708a12cb9834408.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\880200.bat
  2⤵
  - Deletes itself
  PID:2712

C:\Users\Admin\AppData\Local\Temp\880200.bat

Filesize
228B

MD5
7e4971914642c5bffb942e001fcb05e3

SHA1
a2a82a45047aa725c424e42770e4dc31ea7ea21d

SHA256
7317a113a02fd7ff4abb53a10b82025d1338cafe1b1915aa725bbfa3eac7e6f3

SHA512
aef2c1fa9f3b6937607d247ee569686949b61219f164435b90bc39ab792eb1f8d4c1f8d575d2484353423462b14c16e61feef6aeab31b57498fff900e157a0b8

Download Submit
memory/1680-0-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/1680-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1680-9-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download