e48018d7861a61c0a2e635fb28125376d7458d4f68f257db74a069b1c0014e5f

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 10:41

Target

a1a99f25d6cca8d6e1cdeaa6d7bd45ca.exe
Size

83KB
MD5

a1a99f25d6cca8d6e1cdeaa6d7bd45ca
SHA1

3919fc444b6f1e651b3ee2df265fc8ed7f18296e
SHA256

e48018d7861a61c0a2e635fb28125376d7458d4f68f257db74a069b1c0014e5f
SHA512

0e604f5e94ff87cc522dacdfae42f1187b024b2e8c350d792e5b3d3126d7d051ea1ed7ecb0d8bca128e527fbbf32b0de4c223314d984b10fe8c73db2b1797ce0
SSDEEP

1536:czVyge9lVIM14sdY6kk6FN6KnoMak+zkwNU18iIAu8mktD+DR3jKQPaCe7V:cBypOjb/6KnYkiNuojC2R3b5eh

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2352-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2352-1-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\lucmx	a1a99f25d6cca8d6e1cdeaa6d7bd45ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	a1a99f25d6cca8d6e1cdeaa6d7bd45ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	a1a99f25d6cca8d6e1cdeaa6d7bd45ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	a1a99f25d6cca8d6e1cdeaa6d7bd45ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\lucmx\\command	a1a99f25d6cca8d6e1cdeaa6d7bd45ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	a1a99f25d6cca8d6e1cdeaa6d7bd45ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\lucmx	a1a99f25d6cca8d6e1cdeaa6d7bd45ca.exe

C:\Users\Admin\AppData\Local\Temp\a1a99f25d6cca8d6e1cdeaa6d7bd45ca.exe
"C:\Users\Admin\AppData\Local\Temp\a1a99f25d6cca8d6e1cdeaa6d7bd45ca.exe"
1⤵
- Modifies registry class
PID:2352

memory/2352-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2352-1-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download