41f4ab5ff8f820a11dd1b736ecb3e8cefa6202ecadd932bb9de59c7668563742

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 21:50

Target

a2d36ca61e4c87a98e1f2b1478aa937a.exe
Size

2.9MB
MD5

a2d36ca61e4c87a98e1f2b1478aa937a
SHA1

8ed53560c062d5dea3166854f7f217cdd01a85ef
SHA256

41f4ab5ff8f820a11dd1b736ecb3e8cefa6202ecadd932bb9de59c7668563742
SHA512

0457eed8d9ca463b7b85eb5da986dfa43019df96c083a8025b0e25e441f5b870b755947b345b90bb698a7247fa9c03b3685a514ad68413ea6f04fd3924cbf6a6
SSDEEP

49152:hMGqNkGvdKTAOqQct4iAqK/BgBYoc1P4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:7x0MsAos/eBYoc1gg3gnl/IVUs1jePs

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2716	a2d36ca61e4c87a98e1f2b1478aa937a.exe

Executes dropped EXE 1 IoCs

pid	Process
2716	a2d36ca61e4c87a98e1f2b1478aa937a.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/184-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000300000001fc40-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
184	a2d36ca61e4c87a98e1f2b1478aa937a.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
184	a2d36ca61e4c87a98e1f2b1478aa937a.exe
2716	a2d36ca61e4c87a98e1f2b1478aa937a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 184 wrote to memory of 2716	184	a2d36ca61e4c87a98e1f2b1478aa937a.exe	88
PID 184 wrote to memory of 2716	184	a2d36ca61e4c87a98e1f2b1478aa937a.exe	88
PID 184 wrote to memory of 2716	184	a2d36ca61e4c87a98e1f2b1478aa937a.exe	88

C:\Users\Admin\AppData\Local\Temp\a2d36ca61e4c87a98e1f2b1478aa937a.exe

Filesize
1.4MB

MD5
c02d0537ba33fe2c3cb4b02941cf686a

SHA1
53785bed0b044ccf8f902637d205cccce7dc1cb1

SHA256
27a0dba1bdfb3b6a9c4eb15625e9d95a54e8f3dde2e5da227fa4493a6ab8214d

SHA512
e4f869192da7a3958d8df68164f65d50a325bc05a1af043aeae5a71e9820362e7c0a423f579f9c389473d1563c184e3e072e46040c9e2e6c1cc127bd74d657fd

Download Submit
memory/184-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/184-1-0x0000000001D00000-0x0000000001E33000-memory.dmp

Filesize
1.2MB

Download
memory/184-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/184-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2716-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2716-15-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/2716-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2716-20-0x00000000055D0000-0x00000000057FA000-memory.dmp

Filesize
2.2MB

Download
memory/2716-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2716-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download