c79155a70f2f1d1fa96c2f0545b9b744bfd35ef06a650bd1dc802d313c7386e1

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 14:05

Target

3923a737b6572245b708a12cb9834408.exe
Size

518KB
MD5

3923a737b6572245b708a12cb9834408
SHA1

ec472b81aab85f47c6e4f8308f4ce66e038705cd
SHA256

c79155a70f2f1d1fa96c2f0545b9b744bfd35ef06a650bd1dc802d313c7386e1
SHA512

c021549d5d150ff5fb1797975bbba78d5cbcbce14100618b690b33769cffc945da9445cf5a042164104dae77d34644c623b73dfbd7a621dd394813282ffd727a
SSDEEP

12288:R2xx1R2vSMQO3Q/YxXKee5Hj5kW74TcIr+Y5p/j8HLPvjHev:R2vMQr/YWBT4TjqApLGf

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1904-0-0x0000000000400000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1904-4-0x0000000000400000-0x0000000000510000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vccr.zip	3923a737b6572245b708a12cb9834408.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 4904	1904	3923a737b6572245b708a12cb9834408.exe	93
PID 1904 wrote to memory of 4904	1904	3923a737b6572245b708a12cb9834408.exe	93
PID 1904 wrote to memory of 4904	1904	3923a737b6572245b708a12cb9834408.exe	93

C:\Users\Admin\AppData\Local\Temp\3923a737b6572245b708a12cb9834408.exe
"C:\Users\Admin\AppData\Local\Temp\3923a737b6572245b708a12cb9834408.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\710900.bat
  2⤵
  PID:4904

C:\Users\Admin\AppData\Local\Temp\710900.bat

Filesize
228B

MD5
f01a7e8b6fafc004915cf39cdbfc80b3

SHA1
c4adc71937a4fca563e9afbc7473a0d340fd1be0

SHA256
772c904847e675fac4084810415517f95c84ce22ae33a34aa1620bf90e6e280f

SHA512
a22de9aa0f0812ba6ba89f625119f721096344922623b6cd0e9140efadc6a5e9bf3306e28fca8174e871c80e4c4084bb27eb8c3a8d8857aad7238738f1997173

Download Submit
memory/1904-0-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/1904-1-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/1904-4-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download