e7bbdedf21f093bb9b08799c164407bd239221be6689e7c1d39620ffd924919d

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 18:25

Target

704061912e717f63e52fa5fa5dbfa8c5.exe
Size

384KB
MD5

704061912e717f63e52fa5fa5dbfa8c5
SHA1

b527f0340e21566d3494c0a3788385dccf1d0205
SHA256

e7bbdedf21f093bb9b08799c164407bd239221be6689e7c1d39620ffd924919d
SHA512

c2e24c4ffb6c73d6da5c9244557a06c32679ddb199885da59ecdb2483543046252d64d72c27a32c8fa9dab5f9b95c955696d070b0959f313f7a2ec9c9704b6b5
SSDEEP

6144:UiMqbHbEQhY8+/3/pVEbn/cHE/xIU+lVsdXGU/EzTT/F1vD9zeqo:JHbLhY8+/3ETG5zTLPQ

Score

7^/10

aspackv2

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
behavioral2/files/0x0008000000023207-3.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4156	yl_fuck.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 4156	840	704061912e717f63e52fa5fa5dbfa8c5.exe	84
PID 840 wrote to memory of 4156	840	704061912e717f63e52fa5fa5dbfa8c5.exe	84
PID 840 wrote to memory of 4156	840	704061912e717f63e52fa5fa5dbfa8c5.exe	84

C:\Users\Admin\AppData\Local\Temp\704061912e717f63e52fa5fa5dbfa8c5.exe
"C:\Users\Admin\AppData\Local\Temp\704061912e717f63e52fa5fa5dbfa8c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Temp\yl_fuck.exe
  C:\Users\Admin\AppData\Local\Temp\yl_fuck.exe
  2⤵
  - Executes dropped EXE
  PID:4156

C:\Users\Admin\AppData\Local\Temp\yl_fuck.exe

Filesize
9KB

MD5
fbf37911b3960af01edce84345d2909c

SHA1
fc2e7fc4093c9bc693a73748f65cdae2f87ebf1a

SHA256
6b5433a2ec878fc100acb0f2d5107d0764395e5a0d71eb6ef3146b742736380f

SHA512
0c45119591097f4395a1fa48a358e4b8ec5f446dbe06b2a1c495aeaf378a78d4b21d3c6a189b6c805279a69c7924e05b03366b20b69ca268cbfda91574ff7e4c

Download Submit
memory/840-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/840-6-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4156-4-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4156-7-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download