b3fe05b05813444a051fec621f7051a8a8fe5c940e055bd7dff689ae07737e66

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 11:15

Target

a3a3cdfcb8689e9d2b4f6950a25859f3.exe
Size

518KB
MD5

a3a3cdfcb8689e9d2b4f6950a25859f3
SHA1

54b7f8648854cc8a04c2c2227a4fa1547ae45577
SHA256

b3fe05b05813444a051fec621f7051a8a8fe5c940e055bd7dff689ae07737e66
SHA512

82c25c0bf0c850a5f42a360a8975d70f4ec9c23afcb7fc65fbc3286dab5851319ffd96aaa59d4ab31fdd8ed174a4e411547d74c853dd109ebf749f6651f581f5
SSDEEP

12288:42xx1R2vSMQO3Q/YxXKee5HjXkW74TcIr+Y5p/j8HLPvjHev:42vMQr/YWBd4TjqApLGf

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2280-0-0x0000000000400000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2280-4-0x0000000000400000-0x0000000000510000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vccr.zip	a3a3cdfcb8689e9d2b4f6950a25859f3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 1956	2280	a3a3cdfcb8689e9d2b4f6950a25859f3.exe	86
PID 2280 wrote to memory of 1956	2280	a3a3cdfcb8689e9d2b4f6950a25859f3.exe	86
PID 2280 wrote to memory of 1956	2280	a3a3cdfcb8689e9d2b4f6950a25859f3.exe	86

C:\Users\Admin\AppData\Local\Temp\a3a3cdfcb8689e9d2b4f6950a25859f3.exe
"C:\Users\Admin\AppData\Local\Temp\a3a3cdfcb8689e9d2b4f6950a25859f3.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\728300.bat
  2⤵
  PID:1956

C:\Users\Admin\AppData\Local\Temp\728300.bat

Filesize
228B

MD5
9a6ca26cd653330035b03f9626f2a87e

SHA1
26ff397b304587df841ebcf2955cd2f8c07f0a89

SHA256
19c4e3a0f11c6e88e4d46a28bd47c3a924b57578f3322f896ebb2c766b29266e

SHA512
9cc972c7cceb94cf1c71a00288664d9e999f84fe3fa46f01bd2146ab7a85c6a670656258d81461ef86d4d5e3d1bb43df1a7db6dd976ef8537a14f11f6d7236d7

Download Submit
memory/2280-0-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/2280-1-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/2280-4-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download