4db44647eade7afd17961e63e7f8afe59ee5b6e4196584fceefc7549b63cda11

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 14:52

Target

56c22b049c955d318614644c11415e19.exe
Size

2.7MB
MD5

56c22b049c955d318614644c11415e19
SHA1

6d54270a7e211abda3667f9c94512d7b4f6437d0
SHA256

4db44647eade7afd17961e63e7f8afe59ee5b6e4196584fceefc7549b63cda11
SHA512

2746b831a5924a7db7ea0e473c6114eea5318d2e9ccb8460c1c4f422b5b387d61736b967576ef4ba6a312e08f8dc8f3887ae0b8629df240cba730955005e6e7b
SSDEEP

49152:BZTKEZjgdcdL/4jgZ4QrR9ktBc1+Q4YdxSChG38bDUggR9t:DdZjgdoLg2HktBcwQDM2YIDULHt

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2244	56c22b049c955d318614644c11415e19.exe

Executes dropped EXE 1 IoCs

pid	Process
2244	56c22b049c955d318614644c11415e19.exe

Loads dropped DLL 1 IoCs

pid	Process
2124	56c22b049c955d318614644c11415e19.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2244-16-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000a000000012255-15.dat	upx
behavioral1/memory/2124-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2124	56c22b049c955d318614644c11415e19.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2124	56c22b049c955d318614644c11415e19.exe
2244	56c22b049c955d318614644c11415e19.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2244	2124	56c22b049c955d318614644c11415e19.exe	1
PID 2124 wrote to memory of 2244	2124	56c22b049c955d318614644c11415e19.exe	1
PID 2124 wrote to memory of 2244	2124	56c22b049c955d318614644c11415e19.exe	1
PID 2124 wrote to memory of 2244	2124	56c22b049c955d318614644c11415e19.exe	1

C:\Users\Admin\AppData\Local\Temp\56c22b049c955d318614644c11415e19.exe

Filesize
2.7MB

MD5
4b6d77a45c8962d99f0b0536b28e932e

SHA1
65e601fc29083235921dc89f34562f2d7c6011fa

SHA256
bb35e6b48db208e1429697667a0290847d0432b9b618f9563e2e155550d7e042

SHA512
4ad4ad76d3b1dd93b95a2c2c95ab04f1ea7eedcb042eecdf5ee5ee054fad3139caaaa32960beceb951d51593ecba11b9366a4af7425bf77811ec5da010eb6fc8

Download Submit
memory/2124-14-0x0000000003620000-0x0000000003B07000-memory.dmp

Filesize
4.9MB

Download
memory/2124-13-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2124-2-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2124-1-0x00000000002B0000-0x00000000003E1000-memory.dmp

Filesize
1.2MB

Download
memory/2124-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2244-25-0x0000000003630000-0x0000000003852000-memory.dmp

Filesize
2.1MB

Download
memory/2244-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2244-19-0x0000000000230000-0x0000000000361000-memory.dmp

Filesize
1.2MB

Download
memory/2244-17-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2244-16-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2244-31-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download