b3fe05b05813444a051fec621f7051a8a8fe5c940e055bd7dff689ae07737e66

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 11:15

Target

a3a3cdfcb8689e9d2b4f6950a25859f3.exe
Size

518KB
MD5

a3a3cdfcb8689e9d2b4f6950a25859f3
SHA1

54b7f8648854cc8a04c2c2227a4fa1547ae45577
SHA256

b3fe05b05813444a051fec621f7051a8a8fe5c940e055bd7dff689ae07737e66
SHA512

82c25c0bf0c850a5f42a360a8975d70f4ec9c23afcb7fc65fbc3286dab5851319ffd96aaa59d4ab31fdd8ed174a4e411547d74c853dd109ebf749f6651f581f5
SSDEEP

12288:42xx1R2vSMQO3Q/YxXKee5HjXkW74TcIr+Y5p/j8HLPvjHev:42vMQr/YWBd4TjqApLGf

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2520	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2092-0-0x0000000000400000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2092-9-0x0000000000400000-0x0000000000510000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vccr.zip	a3a3cdfcb8689e9d2b4f6950a25859f3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2520	2092	a3a3cdfcb8689e9d2b4f6950a25859f3.exe	28
PID 2092 wrote to memory of 2520	2092	a3a3cdfcb8689e9d2b4f6950a25859f3.exe	28
PID 2092 wrote to memory of 2520	2092	a3a3cdfcb8689e9d2b4f6950a25859f3.exe	28
PID 2092 wrote to memory of 2520	2092	a3a3cdfcb8689e9d2b4f6950a25859f3.exe	28

C:\Users\Admin\AppData\Local\Temp\a3a3cdfcb8689e9d2b4f6950a25859f3.exe
"C:\Users\Admin\AppData\Local\Temp\a3a3cdfcb8689e9d2b4f6950a25859f3.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\735000.bat
  2⤵
  - Deletes itself
  PID:2520

C:\Users\Admin\AppData\Local\Temp\735000.bat

Filesize
228B

MD5
2ecdc8283f3cc44867cf1bf99241dd62

SHA1
c51ef025f88fec013b62f3d5a55dafb26357ce8e

SHA256
e43f24b7c1052d4635aacc414cc66ed7dd5bf0a1da18085b380382190440c58a

SHA512
6c4798a87ef09565a6710780c8a44c5dc0792084594df534549e7d70fcaa71717019ac17bb1bc9330ef4b983f870892a9b06bf4e64b826ba77df0f5cab25a4d4

Download Submit
memory/2092-0-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/2092-1-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2092-9-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download