2cc5027cf8b920db1a6662555732b504ef92db8ef094cbc86595c74a94d1dee2

Analysis

max time kernel
142s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 06:56

Target

b6ca3c9a3f956dfb0bb06675a07cb2d1.exe
Size

7.8MB
MD5

b6ca3c9a3f956dfb0bb06675a07cb2d1
SHA1

57975e737d952f9d8543f1ffb9e3731e9e809e27
SHA256

2cc5027cf8b920db1a6662555732b504ef92db8ef094cbc86595c74a94d1dee2
SHA512

3e06cce72479772fc1ccd87129d44741bd3a43386fa65a52f3e22301aff335ab514764dc6c27d1d5a8874a51cc8b3177702f6d9aa79122cdd2c8709ef3c28ebd
SSDEEP

98304:ll6Nn4c0gg3gnl/IVURsHzyHgg3gnl/IVUyVWwW7Maulfigg3gnl/IVURsHzyHg/:lltBgl/ibulgl/ilVW3ngl/ibulgl/iG

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
1352	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe

Executes dropped EXE 1 IoCs

pid	Process
1352	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5068-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000700000001e59e-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5068	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
5068	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe
1352	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 1352	5068	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe	89
PID 5068 wrote to memory of 1352	5068	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe	89
PID 5068 wrote to memory of 1352	5068	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe	89

C:\Users\Admin\AppData\Local\Temp\b6ca3c9a3f956dfb0bb06675a07cb2d1.exe

Filesize
3.9MB

MD5
c3b8b3558772c1c8a4dcc0d1485b2d98

SHA1
4f8e8126e03f4523e83cb5cb79e88c79c61aeaae

SHA256
2b8fc15cb11f45c7ed513cc5dd023df02eca33fddf6207a0aae432aeb87aef16

SHA512
83e3dddb31833525591d580415ad67ebc36d2600edc96432404cba055dcf49664dad1e68185481ddc1e4dbc293170d3d8a3c5c23fa8f4893dfd91f8b47abd18a

Download Submit
memory/1352-13-0x0000000001D20000-0x0000000001E53000-memory.dmp

Filesize
1.2MB

Download
memory/1352-15-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1352-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1352-20-0x0000000005620000-0x000000000584A000-memory.dmp

Filesize
2.2MB

Download
memory/1352-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1352-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/5068-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/5068-1-0x0000000001CD0000-0x0000000001E03000-memory.dmp

Filesize
1.2MB

Download
memory/5068-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/5068-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download