1dba3997a0115bdabb78491a2e30bd1b876ba5847a316a664e17c886c33e623b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 07:12

Target

5a9b086b6dccfe39d06061358a13f113.exe
Size

5.8MB
MD5

5a9b086b6dccfe39d06061358a13f113
SHA1

6540a09fd58a323fc603af7db3a77b5992973fe2
SHA256

1dba3997a0115bdabb78491a2e30bd1b876ba5847a316a664e17c886c33e623b
SHA512

42561856442f0e45f237e02704255755ce284c68e2da5cf572a8c1d73256fde4e354b8a7b2f5afe8a3167e1aa3b47408fd6c64e913d4433f33dcdf3ddc15ca16
SSDEEP

98304:3ULWVNkD68gnw4Pop4HBUCczzM3ckpB/Bdl7D8PhIw2AVL4HBUCczzM3:A+Ignw4PoKWCQK/B7D8PhVVEWC

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2840	5a9b086b6dccfe39d06061358a13f113.exe

Executes dropped EXE 1 IoCs

pid	Process
2840	5a9b086b6dccfe39d06061358a13f113.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3988-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000a0000000230f9-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3988	5a9b086b6dccfe39d06061358a13f113.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3988	5a9b086b6dccfe39d06061358a13f113.exe
2840	5a9b086b6dccfe39d06061358a13f113.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 2840	3988	5a9b086b6dccfe39d06061358a13f113.exe	89
PID 3988 wrote to memory of 2840	3988	5a9b086b6dccfe39d06061358a13f113.exe	89
PID 3988 wrote to memory of 2840	3988	5a9b086b6dccfe39d06061358a13f113.exe	89

C:\Users\Admin\AppData\Local\Temp\5a9b086b6dccfe39d06061358a13f113.exe

Filesize
519KB

MD5
4971720f9e2d2b0db02b9a9b9b7bf121

SHA1
3d3df051d84605743e9f5910f820ddc4a99b1ff8

SHA256
46589f21aa1f9347a7c6a8411c49ec174140430b6d9bdd872fdbc504a2f035db

SHA512
36f060c784f43898430dba680bfd274a6ebd9c2641a0ff0edaba5e48cc22c524424762f49dcb80a10f4ebc0ba35efadf776a6a0f64fa4c61c826f3fd714705a9

Download Submit
memory/2840-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-13-0x0000000001C30000-0x0000000001D63000-memory.dmp

Filesize
1.2MB

Download
memory/2840-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2840-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2840-20-0x0000000005530000-0x000000000575A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3988-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3988-1-0x0000000001D00000-0x0000000001E33000-memory.dmp

Filesize
1.2MB

Download
memory/3988-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3988-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download