dd9e6a91f6f5bc20d1d11c5b8078205ab4a75b32721946881ba91550c5af1cb0

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 07:11

Target

b6d27f30280dff7852c60f498c021ede.exe
Size

1003KB
MD5

b6d27f30280dff7852c60f498c021ede
SHA1

964ca1accd10f42b4afc785e1f46c1da52843471
SHA256

dd9e6a91f6f5bc20d1d11c5b8078205ab4a75b32721946881ba91550c5af1cb0
SHA512

ebe520f485d965cd8b12ca7fad3591409988be7d9f5cb89f80083c432cdd027c30f6a9a0cc8aed20938fbdd336c32fd300438a6246e3a1bae34c756517037417
SSDEEP

24576:bKjBkniNZyhOMBbNLFWYi1dIudI2ory+s3qKD:betNZyhOMBbNLUYi1dIFry+l

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2860-0-0x0000000000400000-0x000000000065C000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2860	b6d27f30280dff7852c60f498c021ede.exe

C:\Users\Admin\AppData\Local\Temp\b6d27f30280dff7852c60f498c021ede.exe
"C:\Users\Admin\AppData\Local\Temp\b6d27f30280dff7852c60f498c021ede.exe"
1⤵
- Suspicious use of UnmapMainImage
PID:2860

memory/2860-1-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2860-3-0x0000000000320000-0x000000000039E000-memory.dmp

Filesize
504KB

Download
memory/2860-0-0x0000000000400000-0x000000000065C000-memory.dmp

Filesize
2.4MB

Download
memory/2860-6-0x0000000000400000-0x000000000065C000-memory.dmp

Filesize
2.4MB

Download