18cbd7f76ab24346edaabe4597fad8ede119385e9dc8e7e459f191484ad43f7f

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 21:29

Target

8a93e65dcd3e21f18bba04a408711af9.exe
Size

83KB
MD5

8a93e65dcd3e21f18bba04a408711af9
SHA1

04d7a16ef76f4106bc970c380df78e84f8c09e9b
SHA256

18cbd7f76ab24346edaabe4597fad8ede119385e9dc8e7e459f191484ad43f7f
SHA512

9e4156f990eb9cc85ff7e311d1e9165b82010c43a4abf0fe08a00f0e7f2687f3ad8beb256f3b35ac6278ac26c73957d8be0eebb5145d89f7c098cbedb7a9fc03
SSDEEP

1536:giRoI8G2OmiH1OnUfKmss6r+zpQ/gl0A6Vokq0GluRuL2NXPu1l2UdrCtre:giRoaRmg125mss6r+zpQS0ckJ3R/u1L7

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2384-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/2384-1-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\bnvan	8a93e65dcd3e21f18bba04a408711af9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	8a93e65dcd3e21f18bba04a408711af9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	8a93e65dcd3e21f18bba04a408711af9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	8a93e65dcd3e21f18bba04a408711af9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\bnvan\\command	8a93e65dcd3e21f18bba04a408711af9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	8a93e65dcd3e21f18bba04a408711af9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\bnvan	8a93e65dcd3e21f18bba04a408711af9.exe

C:\Users\Admin\AppData\Local\Temp\8a93e65dcd3e21f18bba04a408711af9.exe
"C:\Users\Admin\AppData\Local\Temp\8a93e65dcd3e21f18bba04a408711af9.exe"
1⤵
- Modifies registry class
PID:2384

memory/2384-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2384-1-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download