78142da8ae2bf87830295cf35b8cecdbf51e66f916d19efc8c3f6dbe251c94b9

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25-02-2024 16:14

Target

a438c5ce8f98d7fedbfde163966a3e8d.exe
Size

5.8MB
MD5

a438c5ce8f98d7fedbfde163966a3e8d
SHA1

81dfd9be7c96a747137eb2ba99b54fc2b83682b1
SHA256

78142da8ae2bf87830295cf35b8cecdbf51e66f916d19efc8c3f6dbe251c94b9
SHA512

aea2332203096e055ebe9c3c5a114e10c3d507af673c4def64ef7568561243dba61f215aaccb671c92c396d1792ff4f4fb1d6fe7807295a4e13fdbc32484462c
SSDEEP

98304:UHnNFADCeiGQZaXhP5a9UEI+eG9jAkbkR79D+cVItGQZaXhP5a9UEI+eG:AAue8GhRaaCkN9qHGhRa

Score

7^/10

upx

Deletes itself 1 IoCs

Processes:

a438c5ce8f98d7fedbfde163966a3e8d.exe

pid process

2980 a438c5ce8f98d7fedbfde163966a3e8d.exe
Executes dropped EXE 1 IoCs

Processes:

a438c5ce8f98d7fedbfde163966a3e8d.exe

pid process

2980 a438c5ce8f98d7fedbfde163966a3e8d.exe
Loads dropped DLL 1 IoCs

Processes:

a438c5ce8f98d7fedbfde163966a3e8d.exe

pid process

2156 a438c5ce8f98d7fedbfde163966a3e8d.exe

pid	process
2980	a438c5ce8f98d7fedbfde163966a3e8d.exe

pid	process
2980	a438c5ce8f98d7fedbfde163966a3e8d.exe

pid	process
2156	a438c5ce8f98d7fedbfde163966a3e8d.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2156-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\a438c5ce8f98d7fedbfde163966a3e8d.exe	upx

Suspicious behavior: RenamesItself 1 IoCs

Processes:

a438c5ce8f98d7fedbfde163966a3e8d.exe

pid process

2156 a438c5ce8f98d7fedbfde163966a3e8d.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

a438c5ce8f98d7fedbfde163966a3e8d.exea438c5ce8f98d7fedbfde163966a3e8d.exe

pid process

2156 a438c5ce8f98d7fedbfde163966a3e8d.exe
2980 a438c5ce8f98d7fedbfde163966a3e8d.exe

pid	process
2156	a438c5ce8f98d7fedbfde163966a3e8d.exe

pid	process
2156	a438c5ce8f98d7fedbfde163966a3e8d.exe
2980	a438c5ce8f98d7fedbfde163966a3e8d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a438c5ce8f98d7fedbfde163966a3e8d.exe

description	pid	process	target process
PID 2156 wrote to memory of 2980	2156	a438c5ce8f98d7fedbfde163966a3e8d.exe	a438c5ce8f98d7fedbfde163966a3e8d.exe
PID 2156 wrote to memory of 2980	2156	a438c5ce8f98d7fedbfde163966a3e8d.exe	a438c5ce8f98d7fedbfde163966a3e8d.exe
PID 2156 wrote to memory of 2980	2156	a438c5ce8f98d7fedbfde163966a3e8d.exe	a438c5ce8f98d7fedbfde163966a3e8d.exe
PID 2156 wrote to memory of 2980	2156	a438c5ce8f98d7fedbfde163966a3e8d.exe	a438c5ce8f98d7fedbfde163966a3e8d.exe

\Users\Admin\AppData\Local\Temp\a438c5ce8f98d7fedbfde163966a3e8d.exe
Filesize
5.8MB

MD5
beea700735004e6320bae380e5da00dd

SHA1
8f697de8d069b8e9d9594254061dc360046bf380

SHA256
2bb2a4e2ac7a572c5926544679b99a4bdedb1316ef87913dc55ba897dcb9e9ae

SHA512
19b01420ed1a0c9c90983d4f6d5b6401d7c64ac351c91bc916f3a31debc84df39bc993ac958b409ea26a23bc02b35f0f840eaa7b54a7bdc77262ef9963f1a808

Download Submit
memory/2156-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2156-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2156-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2156-14-0x0000000003DD0000-0x00000000042BF000-memory.dmp

Filesize
4.9MB

Download
memory/2156-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2980-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2980-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2980-18-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2980-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2980-25-0x0000000003430000-0x000000000365A000-memory.dmp

Filesize
2.2MB

Download
memory/2980-31-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download