e3d4d50a8a4c201b5490a860e0fceef4d85c392b55eb5b4fe36dfae5a9dfb3b4

Analysis

max time kernel
159s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 05:50

Target

4fc12515d312d125813ed23cbe1c4682.exe
Size

84KB
MD5

4fc12515d312d125813ed23cbe1c4682
SHA1

33be280c4a6bd637cb84d9a1f5726ce146bb72f6
SHA256

e3d4d50a8a4c201b5490a860e0fceef4d85c392b55eb5b4fe36dfae5a9dfb3b4
SHA512

a9505a69f8aa7b71aae9814f22df99900793170c1eda99d4537a8d4cc028d772cedb6f4c9646e6f0d2dd7ac4d67526e265a2ad0d62ce32814e006f0115747654
SSDEEP

1536:1sI7dw3kjBtAr7waBjv8+ShZEaEkDSd/nPzI6jvGsA3pM3jnaH9wdiutg:1sirAr7njnShuaWdkovnjnE9wd9g

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3700-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3700-1-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3700-3-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	4fc12515d312d125813ed23cbe1c4682.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\tykix	4fc12515d312d125813ed23cbe1c4682.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\tykix	4fc12515d312d125813ed23cbe1c4682.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	4fc12515d312d125813ed23cbe1c4682.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	4fc12515d312d125813ed23cbe1c4682.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	4fc12515d312d125813ed23cbe1c4682.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\tykix\\command	4fc12515d312d125813ed23cbe1c4682.exe

C:\Users\Admin\AppData\Local\Temp\4fc12515d312d125813ed23cbe1c4682.exe
"C:\Users\Admin\AppData\Local\Temp\4fc12515d312d125813ed23cbe1c4682.exe"
1⤵
- Modifies registry class
PID:3700

memory/3700-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3700-1-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3700-3-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download