430db1faea05541d603cc35e54fd15314cb921e7b2f67f83c210e2162b9943df

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 00:26

Target

95c40f230491c2f4bf02d6d768b233ed.exe
Size

141KB
MD5

95c40f230491c2f4bf02d6d768b233ed
SHA1

c3177929b82f8f770acf1a91e028474c2d2cbcb3
SHA256

430db1faea05541d603cc35e54fd15314cb921e7b2f67f83c210e2162b9943df
SHA512

50ac0db16cc91d61069d19c83f4622330d3275522b6fb7273fb17431e2c79d8bb474ef4a626d6900a3b677aa517be673171d8448c083b0e969df6e8c2f6d7931
SSDEEP

3072:mHrm5R1J6Rd3vK0S/fDlxB7ZL/Qtl+IHj61P9IDLBC0B28vOIu10J:r5RosxBN/UWYxJ2hJ

Score

8^/10

upx

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\zjtxuixhbrr5.sys	95c40f230491c2f4bf02d6d768b233ed.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2440	2200	95c40f230491c2f4bf02d6d768b233ed.exe	28
PID 2200 wrote to memory of 2440	2200	95c40f230491c2f4bf02d6d768b233ed.exe	28
PID 2200 wrote to memory of 2440	2200	95c40f230491c2f4bf02d6d768b233ed.exe	28
PID 2200 wrote to memory of 2440	2200	95c40f230491c2f4bf02d6d768b233ed.exe	28

C:\Users\Admin\AppData\Local\Temp\95c40f230491c2f4bf02d6d768b233ed.exe
"C:\Users\Admin\AppData\Local\Temp\95c40f230491c2f4bf02d6d768b233ed.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ureubhanlay.bat
  2⤵
  PID:2440

C:\Users\Admin\AppData\Local\Temp\ureubhanlay.bat

Filesize
231B

MD5
88c4a9cd5c660b38d7316629482ca764

SHA1
2f3049105478f51cd22d7b056b4fd1126f9d754f

SHA256
9a0cdaa2f7cd7e25f0554337d3d2b4fc89987dafc87acb3ac3bdb0e0f9407f7c

SHA512
3a88bb3a2c0cf6a75454515941099f7d6c597ddb9147a991662551a578fa417da043112d3192c128e0444477b072183ad77b7908b5196eeb80063a3a3f2adb98

Download Submit
memory/2200-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2200-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2200-2-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2200-12-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2200-13-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download