8daa0381b3377ca95811054c03aaa6ac08b8f27801e2876f04fb80bd86317940

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 03:58

Target

a0e3d31c8b6ee48ad7c807996247d350.exe
Size

2.7MB
MD5

a0e3d31c8b6ee48ad7c807996247d350
SHA1

ca86d4d9da1f88140825f68421e742f7507e37d2
SHA256

8daa0381b3377ca95811054c03aaa6ac08b8f27801e2876f04fb80bd86317940
SHA512

6fa958abc1d15fd9f22cb5867fd5214541c82ee39fe36dfac8c43975377739e92b414759d8b7a7b4bef607c56ee921507be693754d87530a3b654dbdd4ab5f33
SSDEEP

49152:FFzcopYmrPJPpnsSckhnEugR9TJdlB4011X3rTEK4lhVMqJtKZJhJX9HR9j:nLYEppsjkngHTJdzz1HrYK4nm6+JhJXt

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2300	a0e3d31c8b6ee48ad7c807996247d350.exe

Executes dropped EXE 1 IoCs

pid	Process
2300	a0e3d31c8b6ee48ad7c807996247d350.exe

Loads dropped DLL 1 IoCs

pid	Process
2944	a0e3d31c8b6ee48ad7c807996247d350.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2944-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000c000000012352-10.dat	upx
behavioral1/memory/2300-16-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/memory/2944-14-0x0000000003820000-0x0000000003D07000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2944	a0e3d31c8b6ee48ad7c807996247d350.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2944	a0e3d31c8b6ee48ad7c807996247d350.exe
2300	a0e3d31c8b6ee48ad7c807996247d350.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2300	2944	a0e3d31c8b6ee48ad7c807996247d350.exe	28
PID 2944 wrote to memory of 2300	2944	a0e3d31c8b6ee48ad7c807996247d350.exe	28
PID 2944 wrote to memory of 2300	2944	a0e3d31c8b6ee48ad7c807996247d350.exe	28
PID 2944 wrote to memory of 2300	2944	a0e3d31c8b6ee48ad7c807996247d350.exe	28

\Users\Admin\AppData\Local\Temp\a0e3d31c8b6ee48ad7c807996247d350.exe

Filesize
2.7MB

MD5
6786099e8af089cf523a55ba6b274d32

SHA1
1c12156085a9a688690efdc3bd1e265de9a1dd26

SHA256
70667795cddd2bd930eb56742e3a03889b91d4f3bfd8f2a7873557591d76b72f

SHA512
bceaf4b8b3ed4daf019d0fc5ca0159acd91c7e65bc4269fc9ea9dd01ac034007916090acf5cccb685b0714db1e4bc7b9a49a9f3f80021063007c93571e830587

Download Submit
memory/2300-16-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2300-17-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2300-18-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/2300-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2300-25-0x00000000033F0000-0x0000000003612000-memory.dmp

Filesize
2.1MB

Download
memory/2300-31-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2944-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2944-1-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2944-2-0x0000000000240000-0x0000000000371000-memory.dmp

Filesize
1.2MB

Download
memory/2944-14-0x0000000003820000-0x0000000003D07000-memory.dmp

Filesize
4.9MB

Download
memory/2944-13-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download