660cac6cf02a914a3978d85a2bad46d2acc36d4d06aa4f78e0bca4f373713ee1

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2024 13:05

Target

4e600334140f7468689353c95cd791a9.exe
Size

124KB
MD5

4e600334140f7468689353c95cd791a9
SHA1

1e6ebc93b05ea4f2ea4693a1b6bdc70336c529b2
SHA256

660cac6cf02a914a3978d85a2bad46d2acc36d4d06aa4f78e0bca4f373713ee1
SHA512

f6d97c8c3ab7a5e96d9862356e087acdd1d7fd2f6317db81428cd24b0fa8deb25cefaaf5550c2ed46b2246380ec8811ebc289b2012e8b52c6c73c3bab51d1077
SSDEEP

1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhMbgueMtx4BO:blN9RkkkkkkTLbYSxmx1q1lshzKj

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2908-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2908-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/files/0x00060000000231ca-6.dat	upx
behavioral2/memory/2908-17-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win32dc\Silent Hill 4 patch.exe	4e600334140f7468689353c95cd791a9.exe
File created	C:\Windows\win32dc\FlatOut + trainer.exe	4e600334140f7468689353c95cd791a9.exe
File opened for modification	C:\Windows\win32dc\Doom 3(patch).exe	4e600334140f7468689353c95cd791a9.exe
File created	C:\Windows\win32dc\UT2004_cheat.exe	4e600334140f7468689353c95cd791a9.exe
File opened for modification	C:\Windows\win32dc\DAoC + cdfix.exe	4e600334140f7468689353c95cd791a9.exe
File created	C:\Windows\win32dc\Counter-Strike(nocd).exe	4e600334140f7468689353c95cd791a9.exe
File created	C:\Windows\win32dc\Doom 3(patch).exe	4e600334140f7468689353c95cd791a9.exe
File created	C:\Windows\win32dc\Half-Life 2_trainer.exe	4e600334140f7468689353c95cd791a9.exe
File created	C:\Windows\win32dc\DAoC + cdfix.exe	4e600334140f7468689353c95cd791a9.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike(nocd).exe	4e600334140f7468689353c95cd791a9.exe
File opened for modification	C:\Windows\win32dc\FlatOut + trainer.exe	4e600334140f7468689353c95cd791a9.exe
File opened for modification	C:\Windows\win32dc\UT2004_cheat.exe	4e600334140f7468689353c95cd791a9.exe
File created	C:\Windows\win32dc\Quake3_hack.exe	4e600334140f7468689353c95cd791a9.exe
File created	C:\Windows\win32dc\FlatOut + crack.exe	4e600334140f7468689353c95cd791a9.exe
File created	C:\Windows\win32dc\Silent Hill 4 patch.exe	4e600334140f7468689353c95cd791a9.exe

C:\Users\Admin\AppData\Local\Temp\4e600334140f7468689353c95cd791a9.exe
"C:\Users\Admin\AppData\Local\Temp\4e600334140f7468689353c95cd791a9.exe"
1⤵
- Drops file in Windows directory
PID:2908

C:\Windows\win32dc\Half-Life 2_trainer.exe

Filesize
124KB

MD5
4e600334140f7468689353c95cd791a9

SHA1
1e6ebc93b05ea4f2ea4693a1b6bdc70336c529b2

SHA256
660cac6cf02a914a3978d85a2bad46d2acc36d4d06aa4f78e0bca4f373713ee1

SHA512
f6d97c8c3ab7a5e96d9862356e087acdd1d7fd2f6317db81428cd24b0fa8deb25cefaaf5550c2ed46b2246380ec8811ebc289b2012e8b52c6c73c3bab51d1077

Download Submit
memory/2908-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2908-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2908-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download