4616798201019a7c59af3bd031eb15497e2e41c37d5eb4c3f02a027ce33f25d9

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 22:28

Target

a2dba417b558502de9fffaf0894c733b.exe
Size

1.3MB
MD5

a2dba417b558502de9fffaf0894c733b
SHA1

f4a388e41a13506a73ef001538d9afa43b3b9842
SHA256

4616798201019a7c59af3bd031eb15497e2e41c37d5eb4c3f02a027ce33f25d9
SHA512

aa70a7451fc21c8f380dfa94fbec47623366ce514abe989978fbdfbfd8861eef5e85256be923e82ee987560684d1ae09e19e7c0dcfb1f7fe312be435e67e53cb
SSDEEP

24576:jazlxN0MV5N2mUZcWADU52Q+hFf/8y5qWOo0Kk1v30HqjS/4Wc:Glrp5sZ6qeFf/8y5qWoKs30Hyp

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2912	a2dba417b558502de9fffaf0894c733b.exe

Executes dropped EXE 1 IoCs

pid	Process
2912	a2dba417b558502de9fffaf0894c733b.exe

Loads dropped DLL 1 IoCs

pid	Process
1220	a2dba417b558502de9fffaf0894c733b.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1220-1-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0008000000012249-10.dat	upx
behavioral1/memory/2912-17-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1220	a2dba417b558502de9fffaf0894c733b.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1220	a2dba417b558502de9fffaf0894c733b.exe
2912	a2dba417b558502de9fffaf0894c733b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2912	1220	a2dba417b558502de9fffaf0894c733b.exe	28
PID 1220 wrote to memory of 2912	1220	a2dba417b558502de9fffaf0894c733b.exe	28
PID 1220 wrote to memory of 2912	1220	a2dba417b558502de9fffaf0894c733b.exe	28
PID 1220 wrote to memory of 2912	1220	a2dba417b558502de9fffaf0894c733b.exe	28

\Users\Admin\AppData\Local\Temp\a2dba417b558502de9fffaf0894c733b.exe

Filesize
1.3MB

MD5
00358932ba6db9ebad4221002c2a2acb

SHA1
5ca80f318f08affd4feabbf0850c99d6fab78da0

SHA256
9bc74f783b968f05966185b0f688bc6e6a61c434b43b328fcc307c5031d3f5a2

SHA512
d525b6f16ad5917f02f2c6d81c8656b108f9672e0d3cc6fa06bf7e07321a729cc5ecbf41e254ca9fb9db4695ef896505acc8fb35f9e4d39c606c65e174fc17d5

Download Submit
memory/1220-1-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1220-0-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1220-3-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/1220-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1220-14-0x00000000034D0000-0x00000000039BF000-memory.dmp

Filesize
4.9MB

Download
memory/2912-18-0x0000000000240000-0x0000000000373000-memory.dmp

Filesize
1.2MB

Download
memory/2912-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2912-19-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2912-26-0x0000000003660000-0x000000000388A000-memory.dmp

Filesize
2.2MB

Download
memory/2912-24-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2912-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download