434c7e677964ada8dc9240630c6dd9ceaa983b01ab9bc1051be128091a5de847

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 16:32

Target

a44138ffe164284f6b12a31c9eeb4dbd.exe
Size

2.9MB
MD5

a44138ffe164284f6b12a31c9eeb4dbd
SHA1

a04fbff926dddaa82ec3379d13caa18a1d859518
SHA256

434c7e677964ada8dc9240630c6dd9ceaa983b01ab9bc1051be128091a5de847
SHA512

424197b8e74ab648ccac68a5e1e17220c088a561f4a7c427aa67028b5102a2ea5293c8ffaa32dd295c91262c45d666cbba82b97129b353955c9b3bba27851f60
SSDEEP

49152:bRw4B5c6GKgdB3BbOwB+Q0iy6phh7bpGYSq1nuV62dUk5oJ:tpfc6XgJbOwB+biychhxGxOnuvdUk5oJ

Score

7^/10

upx

Deletes itself 1 IoCs

Processes:

a44138ffe164284f6b12a31c9eeb4dbd.exe

pid process

3188 a44138ffe164284f6b12a31c9eeb4dbd.exe
Executes dropped EXE 1 IoCs

Processes:

a44138ffe164284f6b12a31c9eeb4dbd.exe

pid process

3188 a44138ffe164284f6b12a31c9eeb4dbd.exe

pid	process
3188	a44138ffe164284f6b12a31c9eeb4dbd.exe

pid	process
3188	a44138ffe164284f6b12a31c9eeb4dbd.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/216-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\a44138ffe164284f6b12a31c9eeb4dbd.exe	upx
behavioral2/memory/3188-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

Processes:

a44138ffe164284f6b12a31c9eeb4dbd.exe

pid process

216 a44138ffe164284f6b12a31c9eeb4dbd.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

a44138ffe164284f6b12a31c9eeb4dbd.exea44138ffe164284f6b12a31c9eeb4dbd.exe

pid process

216 a44138ffe164284f6b12a31c9eeb4dbd.exe
3188 a44138ffe164284f6b12a31c9eeb4dbd.exe

pid	process
216	a44138ffe164284f6b12a31c9eeb4dbd.exe

pid	process
216	a44138ffe164284f6b12a31c9eeb4dbd.exe
3188	a44138ffe164284f6b12a31c9eeb4dbd.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a44138ffe164284f6b12a31c9eeb4dbd.exe

description	pid	process	target process
PID 216 wrote to memory of 3188	216	a44138ffe164284f6b12a31c9eeb4dbd.exe	a44138ffe164284f6b12a31c9eeb4dbd.exe
PID 216 wrote to memory of 3188	216	a44138ffe164284f6b12a31c9eeb4dbd.exe	a44138ffe164284f6b12a31c9eeb4dbd.exe
PID 216 wrote to memory of 3188	216	a44138ffe164284f6b12a31c9eeb4dbd.exe	a44138ffe164284f6b12a31c9eeb4dbd.exe

C:\Users\Admin\AppData\Local\Temp\a44138ffe164284f6b12a31c9eeb4dbd.exe
Filesize
2.9MB

MD5
c513cb015dc3c36e244895535e1f14b7

SHA1
2ef6abbbdd1f12ca6c19e3cab8c14f1a3328ae4c

SHA256
9180f2a06665dc70ec5dbfb7a5d29a7562e7ecd363a762b1b2663ccb91c5d124

SHA512
fc91782f6b75e18d7507d4113c26c36817eb7215e74151da05888bc52b8a12443de7abe438c71bcd69718f029b3937584d067c3be0caf162ef0b3b698d97b9c9

Download Submit
memory/216-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/216-1-0x0000000001CC0000-0x0000000001DF3000-memory.dmp

Filesize
1.2MB

Download
memory/216-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/216-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3188-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3188-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3188-15-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/3188-20-0x00000000055C0000-0x00000000057EA000-memory.dmp

Filesize
2.2MB

Download
memory/3188-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/3188-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download