1998e7352e4dabdac62aed98c010c7635722e55096a4250ccac9993618edd304

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 18:30

Target

b5618a9e6519d22db36eb1ea44f40373.exe
Size

11.7MB
MD5

b5618a9e6519d22db36eb1ea44f40373
SHA1

f89900643e793d4564e22087421ce02352d1dc5f
SHA256

1998e7352e4dabdac62aed98c010c7635722e55096a4250ccac9993618edd304
SHA512

008008341407e9666bc54116e20bbd288c5dd7ce69c4cd79c7fe70cb4fc0f74e0800b9b23ec1a2807fc0486c2caca7ab2a1fa8f97e9606d3769cd94bf5c5d2ca
SSDEEP

196608:GJYlZCgl/iBiPIWI3gl/iBiPrcgl/iBiPIWI3gl/iBiP:IYnC2ix32ij2ix32i

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2944	b5618a9e6519d22db36eb1ea44f40373.exe

Executes dropped EXE 1 IoCs

pid	Process
2944	b5618a9e6519d22db36eb1ea44f40373.exe

Loads dropped DLL 1 IoCs

pid	Process
2972	b5618a9e6519d22db36eb1ea44f40373.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2972-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a00000001224c-10.dat	upx
behavioral1/memory/2944-14-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2972	b5618a9e6519d22db36eb1ea44f40373.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2972	b5618a9e6519d22db36eb1ea44f40373.exe
2944	b5618a9e6519d22db36eb1ea44f40373.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2944	2972	b5618a9e6519d22db36eb1ea44f40373.exe	28
PID 2972 wrote to memory of 2944	2972	b5618a9e6519d22db36eb1ea44f40373.exe	28
PID 2972 wrote to memory of 2944	2972	b5618a9e6519d22db36eb1ea44f40373.exe	28
PID 2972 wrote to memory of 2944	2972	b5618a9e6519d22db36eb1ea44f40373.exe	28

\Users\Admin\AppData\Local\Temp\b5618a9e6519d22db36eb1ea44f40373.exe

Filesize
11.7MB

MD5
90c6607995e955ddefe8a7720cbd82da

SHA1
50c1618dee954ca3284d0e5ea06d184c1c78ac4e

SHA256
2a4dc51a200399b1dfb9ff84d195d1cb0f38aca9db3c616c2664a5a38384b859

SHA512
d3af40ceb1acead1b35bbb65b0a96b084ef1b422287970fadb3101ca3fb53959b6fc8945e93404df4ba1d443640d59eed3b7388d9530aac6428a92bd27bf35e2

Download Submit
memory/2944-14-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2944-15-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2944-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2944-22-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2944-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2944-30-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2972-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2972-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2972-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2972-29-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download