7ee5ab551768a4eb36c7db06da048ca92ff016993b700ead9aa25dd322725099

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 12:47

Target

7a4b6e4a6734a15e46ce8bff1285b48d.exe
Size

78KB
MD5

7a4b6e4a6734a15e46ce8bff1285b48d
SHA1

9d101807ef55ef016e97ffb6a063b79712b8fc2d
SHA256

7ee5ab551768a4eb36c7db06da048ca92ff016993b700ead9aa25dd322725099
SHA512

1688015957e064d8108ed9af849497b6c5e667cdd26a7ae70efb8ba73b624dd96315ea12f36ec97717dc9f4cbede57efcdb255b0b36fe50bf1901eefffc83657
SSDEEP

1536:iD5oC0mEs/YvL5NIdRI6aJOelR2tMZHAf1jTzvL82ekwfD:i0HL5NTHZlRrH0rL8AS

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3684-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3684-1-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\zjznv	7a4b6e4a6734a15e46ce8bff1285b48d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	7a4b6e4a6734a15e46ce8bff1285b48d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	7a4b6e4a6734a15e46ce8bff1285b48d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	7a4b6e4a6734a15e46ce8bff1285b48d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\zjznv\\command	7a4b6e4a6734a15e46ce8bff1285b48d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	7a4b6e4a6734a15e46ce8bff1285b48d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\zjznv	7a4b6e4a6734a15e46ce8bff1285b48d.exe

C:\Users\Admin\AppData\Local\Temp\7a4b6e4a6734a15e46ce8bff1285b48d.exe
"C:\Users\Admin\AppData\Local\Temp\7a4b6e4a6734a15e46ce8bff1285b48d.exe"
1⤵
- Modifies registry class
PID:3684

memory/3684-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3684-1-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download