f37a3c6561b111a616e9ae9dc30dc173bbbf5684a7a8f5b49499018eb7e0e31e

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 06:50

Target

a1377cd4ce5ce56d3823fdb57c140b17.exe
Size

2.7MB
MD5

a1377cd4ce5ce56d3823fdb57c140b17
SHA1

86bbde799c45970f361bc77bd738a29cf9e8557b
SHA256

f37a3c6561b111a616e9ae9dc30dc173bbbf5684a7a8f5b49499018eb7e0e31e
SHA512

7ac5de2e90a05618e6d0f1c58e9ce017f7d60e22b0dc0afb708c2c91de7270f0f3c0d31951f5354ac92a6da80a5ca201a8213f9c807c32093a39f3e6e98edb4c
SSDEEP

49152:ByTjTlwhAi1YoGQ/ara3umGWUda3VfrrER9f+oyQKvBTNDygOm9gc2pU7mbg2dRt:UTH6L+vHhsr4HGkCBygORc2ptldHj

Score

7^/10

upx

Deletes itself 1 IoCs

Processes:

a1377cd4ce5ce56d3823fdb57c140b17.exe

pid process

220 a1377cd4ce5ce56d3823fdb57c140b17.exe
Executes dropped EXE 1 IoCs

Processes:

a1377cd4ce5ce56d3823fdb57c140b17.exe

pid process

220 a1377cd4ce5ce56d3823fdb57c140b17.exe

pid	process
220	a1377cd4ce5ce56d3823fdb57c140b17.exe

pid	process
220	a1377cd4ce5ce56d3823fdb57c140b17.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1456-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\a1377cd4ce5ce56d3823fdb57c140b17.exe	upx
behavioral2/memory/220-13-0x0000000000400000-0x00000000008E7000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

Processes:

a1377cd4ce5ce56d3823fdb57c140b17.exe

pid process

1456 a1377cd4ce5ce56d3823fdb57c140b17.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

a1377cd4ce5ce56d3823fdb57c140b17.exea1377cd4ce5ce56d3823fdb57c140b17.exe

pid process

1456 a1377cd4ce5ce56d3823fdb57c140b17.exe
220 a1377cd4ce5ce56d3823fdb57c140b17.exe

pid	process
1456	a1377cd4ce5ce56d3823fdb57c140b17.exe

pid	process
1456	a1377cd4ce5ce56d3823fdb57c140b17.exe
220	a1377cd4ce5ce56d3823fdb57c140b17.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a1377cd4ce5ce56d3823fdb57c140b17.exe

description	pid	process	target process
PID 1456 wrote to memory of 220	1456	a1377cd4ce5ce56d3823fdb57c140b17.exe	a1377cd4ce5ce56d3823fdb57c140b17.exe
PID 1456 wrote to memory of 220	1456	a1377cd4ce5ce56d3823fdb57c140b17.exe	a1377cd4ce5ce56d3823fdb57c140b17.exe
PID 1456 wrote to memory of 220	1456	a1377cd4ce5ce56d3823fdb57c140b17.exe	a1377cd4ce5ce56d3823fdb57c140b17.exe

C:\Users\Admin\AppData\Local\Temp\a1377cd4ce5ce56d3823fdb57c140b17.exe
Filesize
851KB

MD5
00858025b524964974b575497821a945

SHA1
7aa18cba3c05c98faaee438b78a23f02773c89de

SHA256
1923325adbe09fd3b4ce60c4fcb119a42d20fe10680ef5f0e52e6067c6ab1efd

SHA512
79ce84b906141721631ccb135d7b58f4ee53ed6f336e0bf6cf4ce9eede138d080b57b97f19cb451c49ee6fe9452022ab097bc0ffbb3255cbfec6c1c39f97432e

Download Submit
memory/220-13-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/220-14-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/220-16-0x0000000001D40000-0x0000000001E71000-memory.dmp

Filesize
1.2MB

Download
memory/220-20-0x0000000005630000-0x0000000005852000-memory.dmp

Filesize
2.1MB

Download
memory/220-21-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/220-28-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/1456-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/1456-1-0x0000000001E00000-0x0000000001F31000-memory.dmp

Filesize
1.2MB

Download
memory/1456-2-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1456-12-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download