ecfb8c58ffba56499c121091a298a55353792a5b2b0a10b7eeaad62f187a44bb

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 07:01

Target

74081f22c2d945ae79b2bdb143331fbb.exe
Size

50KB
MD5

74081f22c2d945ae79b2bdb143331fbb
SHA1

0385523eeb56a977884da858956bcad7ee8e43f2
SHA256

ecfb8c58ffba56499c121091a298a55353792a5b2b0a10b7eeaad62f187a44bb
SHA512

2453e97242cc55388c625e56a026907958569fd554967023a12c447fdf10ab0054bc5fe40f26528084b09efe1597a1577ad424c97d4fcfaaad66c22aee30b19a
SSDEEP

1536:T0MD1GzYcLbrLpARZP4qL4h6ZqMRj5c1H:jDUjLjpARh14hApS1H

Score

7^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023200-3.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
1448	regsvr32.exe
1448	regsvr32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0007000000023200-3.dat	upx
behavioral2/memory/1448-6-0x0000000000620000-0x0000000000638000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 1448	3504	74081f22c2d945ae79b2bdb143331fbb.exe	86
PID 3504 wrote to memory of 1448	3504	74081f22c2d945ae79b2bdb143331fbb.exe	86
PID 3504 wrote to memory of 1448	3504	74081f22c2d945ae79b2bdb143331fbb.exe	86

C:\Users\Admin\AppData\Local\Temp\74081f22c2d945ae79b2bdb143331fbb.exe
"C:\Users\Admin\AppData\Local\Temp\74081f22c2d945ae79b2bdb143331fbb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ketopkd3d.dll
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1448

C:\Users\Admin\AppData\Local\Temp\ketopkd3d.dll

Filesize
27KB

MD5
8ed415a5027b4745e98f92272cdcf747

SHA1
2009a9cc6caa764e5bcdd17f1094ccfde75f0de9

SHA256
e2d59c492dfa6e81dd781519ff53fdd793917009a7a9a067755b042780e415ab

SHA512
e45eb43177efe771e0e612f74eea567e4f9b24047808228c470232cb96a3d4940a4b10d667dd35b94baaf47eda3fc28105d3e558907a6e4150ae3c5c957a3253

Download Submit
memory/1448-6-0x0000000000620000-0x0000000000638000-memory.dmp

Filesize
96KB

Download
memory/3504-7-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download