d89ce9aba65ebcfd8a28321e25dea360a7965d0fda2f895bba3a9e2f1cdd5aa1

Analysis

max time kernel
141s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-02-2024 06:43

Target

a5afde0e3e80d9a521017cdfe84064d0.exe
Size

45KB
MD5

a5afde0e3e80d9a521017cdfe84064d0
SHA1

e51cad263e94670b073412de530742f3431db622
SHA256

d89ce9aba65ebcfd8a28321e25dea360a7965d0fda2f895bba3a9e2f1cdd5aa1
SHA512

fbceea4309e9bc39785353ad1913a1009a543ddcaa219a7b014c26941c52e39120b5bbc6925cd30b65cde8c111632ead96de358f171681459a07ca7cfb91e595
SSDEEP

768:RIhi3I9NV/K0a8pWNp1ndqvG1fGKAjHslK1ycDN4PRg8:mhi49fo/7Y18

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2624-4-0x0000000005000000-0x000000000500B000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

Processes:

a5afde0e3e80d9a521017cdfe84064d0.exe

pid process

2624 a5afde0e3e80d9a521017cdfe84064d0.exe

pid	process
2624	a5afde0e3e80d9a521017cdfe84064d0.exe

C:\Users\Admin\AppData\Local\Temp\a5afde0e3e80d9a521017cdfe84064d0.exe
"C:\Users\Admin\AppData\Local\Temp\a5afde0e3e80d9a521017cdfe84064d0.exe"
1⤵
- Suspicious use of UnmapMainImage
PID:2624

memory/2624-1-0x0000000000250000-0x000000000025F000-memory.dmp

Filesize
60KB

Download
memory/2624-0-0x0000000000240000-0x0000000000247000-memory.dmp

Filesize
28KB

Download
memory/2624-2-0x000000000B200000-0x000000000B207000-memory.dmp

Filesize
28KB

Download
memory/2624-3-0x000000000B200000-0x000000000B207000-memory.dmp

Filesize
28KB

Download
memory/2624-4-0x0000000005000000-0x000000000500B000-memory.dmp

Filesize
44KB

Download
memory/2624-6-0x000000000B000000-0x000000000B007000-memory.dmp

Filesize
28KB

Download