8e1b373b6273a3a6da8b1f2c6f70c8dbcb4776215c3ecc74a4bb0a65fdf257b3

Analysis

max time kernel
115s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 02:57

Target

aad2e1e5964be99b895f7601e34fff20.exe
Size

353KB
MD5

aad2e1e5964be99b895f7601e34fff20
SHA1

57fdda082d25a49d66dd68a596c3833ab0eb827e
SHA256

8e1b373b6273a3a6da8b1f2c6f70c8dbcb4776215c3ecc74a4bb0a65fdf257b3
SHA512

166b0814cd63363800ca952f3520c6f530268a0543a53092d63e95944956272a3fc91baa158eef117b86b4cd60a21ba78d80ca58c5aa11fd1976a3b68f1c7578
SSDEEP

6144:PQ6+ch45QzozDeJxyHfsR2JtVsqkZ/pP9rYdxfsLPrPwo+:P99h45QszSJxy/sR2nVsjZ/t9rYTfmE

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
1856	aad2e1e5964be99b895f7601e34fff20.exe

Executes dropped EXE 1 IoCs

pid	Process
1856	aad2e1e5964be99b895f7601e34fff20.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3044-0-0x0000000000400000-0x00000000004F1000-memory.dmp	upx
behavioral2/files/0x000800000002331d-12.dat	upx
behavioral2/memory/1856-14-0x0000000000400000-0x00000000004F1000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3044	aad2e1e5964be99b895f7601e34fff20.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3044	aad2e1e5964be99b895f7601e34fff20.exe
1856	aad2e1e5964be99b895f7601e34fff20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1856	3044	aad2e1e5964be99b895f7601e34fff20.exe	94
PID 3044 wrote to memory of 1856	3044	aad2e1e5964be99b895f7601e34fff20.exe	94
PID 3044 wrote to memory of 1856	3044	aad2e1e5964be99b895f7601e34fff20.exe	94

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4008 --field-trial-handle=3044,i,17059189006398306756,4247826696353232857,262144 --variations-seed-version /prefetch:8
1⤵
PID:4120

C:\Users\Admin\AppData\Local\Temp\aad2e1e5964be99b895f7601e34fff20.exe

Filesize
353KB

MD5
07a7916861e6ee29505a5d57e44e8753

SHA1
7ba913f423f330ee12f622dc74e8d3fbaf852b01

SHA256
c1b279592dc8fdfe72d364d08fc5cc98dfcae2a7d9d1cc33ec63597ba7de5e78

SHA512
a9a13505689e58ed14aa0ef769bdaa7021259d91a6a161819f9d034c7eae2eaf04377954bad3c643e0054dbcbad41535fdf4875ef804f06052ea12114f10cb54

Download Submit
memory/1856-14-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/1856-15-0x00000000001C0000-0x00000000001F3000-memory.dmp

Filesize
204KB

Download
memory/1856-16-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1856-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1856-24-0x0000000004E50000-0x0000000004EA0000-memory.dmp

Filesize
320KB

Download
memory/1856-28-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/3044-0-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/3044-1-0x0000000001500000-0x0000000001533000-memory.dmp

Filesize
204KB

Download
memory/3044-2-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3044-13-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download