5d11102d1c75cc0c614a17af3154bec6da516f94198ab7f23cc246f8680b9acc

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 20:53

Target

3f0da406e05b0e8f85c895433c37b51f.exe
Size

1.5MB
MD5

3f0da406e05b0e8f85c895433c37b51f
SHA1

1c4249ec87dfe842fe8669a437308566bc02adcd
SHA256

5d11102d1c75cc0c614a17af3154bec6da516f94198ab7f23cc246f8680b9acc
SHA512

7f7662f882ed60589d3d7d890c263467d58884229a4a33d005870214db2795e6303b910b0ef9aa5931f8174770bd63b3f66528c75696fb690c56b183baa0bf17
SSDEEP

24576:v72ZbLpHV7cPs7+NVCW1zJbsNm4SPpM7AZrFILXbJ4g11kN7n2cxW:v72rNH+Npb4Ou7+rFIlfkN71

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
4636	3f0da406e05b0e8f85c895433c37b51f.exe

Executes dropped EXE 1 IoCs

pid	Process
4636	3f0da406e05b0e8f85c895433c37b51f.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/864-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x0009000000023221-10.dat	upx
behavioral2/memory/4636-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
864	3f0da406e05b0e8f85c895433c37b51f.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
864	3f0da406e05b0e8f85c895433c37b51f.exe
4636	3f0da406e05b0e8f85c895433c37b51f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 4636	864	3f0da406e05b0e8f85c895433c37b51f.exe	90
PID 864 wrote to memory of 4636	864	3f0da406e05b0e8f85c895433c37b51f.exe	90
PID 864 wrote to memory of 4636	864	3f0da406e05b0e8f85c895433c37b51f.exe	90

C:\Users\Admin\AppData\Local\Temp\3f0da406e05b0e8f85c895433c37b51f.exe

Filesize
1.5MB

MD5
fd6f3903e02fcf512bf415e5a7abe012

SHA1
50220bf5fdc41fde3da342328d5745a7b86e1fc4

SHA256
f0822d504de1c3bc1509728f66e5649b8e20101a99fc5cb947fd366acee9447d

SHA512
0360fb9f57c145174b83f74346a8298c2cac949a882b9f0fa539b63e2c39526e4beee13a69b0bcb4148cc9906388156928ca007536328f3ee2255a183dca0d88

Download Submit
memory/864-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/864-1-0x0000000001DC0000-0x0000000001EF3000-memory.dmp

Filesize
1.2MB

Download
memory/864-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/864-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4636-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4636-15-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/4636-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4636-20-0x0000000005550000-0x000000000577A000-memory.dmp

Filesize
2.2MB

Download
memory/4636-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/4636-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download