db7e46cb4d3c115568ea3daf75f8ec5724328135f0712c8a15fe127eaae88434

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 09:28

Target

b865e03c068e6c5daa0d5b51ac25186e.exe
Size

203KB
MD5

b865e03c068e6c5daa0d5b51ac25186e
SHA1

017c7bb79762e058dee218950eae6ae97ea4c075
SHA256

db7e46cb4d3c115568ea3daf75f8ec5724328135f0712c8a15fe127eaae88434
SHA512

4dc38b3dc139822bf780df64ba55ef216e4dde78214a61b76bf8de53ec183dff0606303e1705248cd66a27bb970f682ff710b4738a7eb0648199dd592983532e
SSDEEP

3072:KorXhVTwi5Dg55dady2tgLLtmhZfKTIUiTN8zQGmbsRZMAAZOZF:Kq84DgUJWSmOTNmMsBcAF

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2912-0-0x0000000000400000-0x0000000000447000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2912-0-0x0000000000400000-0x0000000000447000-memory.dmp	autoit_exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2924	2912	b865e03c068e6c5daa0d5b51ac25186e.exe	28
PID 2912 wrote to memory of 2924	2912	b865e03c068e6c5daa0d5b51ac25186e.exe	28
PID 2912 wrote to memory of 2924	2912	b865e03c068e6c5daa0d5b51ac25186e.exe	28
PID 2912 wrote to memory of 2924	2912	b865e03c068e6c5daa0d5b51ac25186e.exe	28
PID 2912 wrote to memory of 2924	2912	b865e03c068e6c5daa0d5b51ac25186e.exe	28
PID 2912 wrote to memory of 2924	2912	b865e03c068e6c5daa0d5b51ac25186e.exe	28
PID 2912 wrote to memory of 2924	2912	b865e03c068e6c5daa0d5b51ac25186e.exe	28

C:\Users\Admin\AppData\Local\Temp\b865e03c068e6c5daa0d5b51ac25186e.exe
"C:\Users\Admin\AppData\Local\Temp\b865e03c068e6c5daa0d5b51ac25186e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2924

memory/2912-1-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2912-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2912-2-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2912-5-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2924-3-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2924-4-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2924-6-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2924-9-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download