6b6895b15d7b933961e1b658345506ca5b02ae9f83ec090d40a4dc83f77cad6e

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 09:59

Target

b724dc99ebedfe2e7abe8ec345383074.exe
Size

2.9MB
MD5

b724dc99ebedfe2e7abe8ec345383074
SHA1

40301964e7ebc7826a5f8da17f8ec3892d20b5b7
SHA256

6b6895b15d7b933961e1b658345506ca5b02ae9f83ec090d40a4dc83f77cad6e
SHA512

7296e62a8f23aa4d0666840c30d6550e337673f1993fd1ed6f0eff3bfea53f6732e88fad8e3073129cad31836f274e1215f044018fd5b3a916c729af3e7ae6da
SSDEEP

49152:nkEpLlNt8dy+Mc8zjSmuumRYuEGP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:kEpL9g1M7zjSmG3gg3gnl/IVUs1jePs

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
560	b724dc99ebedfe2e7abe8ec345383074.exe

Executes dropped EXE 1 IoCs

pid	Process
560	b724dc99ebedfe2e7abe8ec345383074.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1868-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x0008000000023265-12.dat	upx
behavioral2/memory/560-14-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1868	b724dc99ebedfe2e7abe8ec345383074.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1868	b724dc99ebedfe2e7abe8ec345383074.exe
560	b724dc99ebedfe2e7abe8ec345383074.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 560	1868	b724dc99ebedfe2e7abe8ec345383074.exe	97
PID 1868 wrote to memory of 560	1868	b724dc99ebedfe2e7abe8ec345383074.exe	97
PID 1868 wrote to memory of 560	1868	b724dc99ebedfe2e7abe8ec345383074.exe	97

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5008

C:\Users\Admin\AppData\Local\Temp\b724dc99ebedfe2e7abe8ec345383074.exe

Filesize
2.0MB

MD5
8c6fb99be05af57c6ad38b7e083e2c5f

SHA1
c66e82385ebeb021d4a11c8d7157713fbec1c87a

SHA256
7344f201c79a3e77aeefc7b11882756bb1288710d6b1bc37a259fd43ce3732fd

SHA512
325988898a8da6ec2159182570f4e35d72f63a6106ede63d5083c15ae46b6c44c7c392c5d9bba2385a9ff706ff34570a969908adeba4c830f620d2f5276d6631

Download Submit
memory/560-14-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/560-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/560-16-0x0000000001DB0000-0x0000000001EE3000-memory.dmp

Filesize
1.2MB

Download
memory/560-21-0x00000000056B0000-0x00000000058DA000-memory.dmp

Filesize
2.2MB

Download
memory/560-22-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/560-29-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1868-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1868-1-0x0000000001CF0000-0x0000000001E23000-memory.dmp

Filesize
1.2MB

Download
memory/1868-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1868-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download