537e905a29496389b98a86cf0e0f99c5eb1d1350e451f9594644dad09b12db26 | Triage

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 20:16

Sharing

Report Analysis Logs

General

Target

b59131cc8d6fd56eb755c28a5d24e00f.exe
Size

99KB
MD5

b59131cc8d6fd56eb755c28a5d24e00f
SHA1

412d8e2f5d47e830b4a4292c024ffb79f794f6ae
SHA256

537e905a29496389b98a86cf0e0f99c5eb1d1350e451f9594644dad09b12db26
SHA512

38ebacf5ef442c8ab4969cfaeea75c990b1cbc261d0d84ccad7d46306d81fe2f79ff306b11b6b831f4c378910a721cf49b2b715009d6bdc0b73c30c5303e5b2f
SSDEEP

3072:TfVAaRM24vvhmdU+ap36vY54bYDGiVv+kl4F15OVb:TV4vhmWl319lNV

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1952-0-0x0000000000400000-0x000000000042C000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1952	b59131cc8d6fd56eb755c28a5d24e00f.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 3560	1952	b59131cc8d6fd56eb755c28a5d24e00f.exe	57
PID 1952 wrote to memory of 3560	1952	b59131cc8d6fd56eb755c28a5d24e00f.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3560
- C:\Users\Admin\AppData\Local\Temp\b59131cc8d6fd56eb755c28a5d24e00f.exe
  "C:\Users\Admin\AppData\Local\Temp\b59131cc8d6fd56eb755c28a5d24e00f.exe"
  2⤵
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1952-1-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/1952-3-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1952-2-0x0000000000500000-0x000000000051A000-memory.dmp

Filesize
104KB

Download