3c4434bf2f85910265e7fc2e402088a7a42f7659ebeba7c163e260bd4935e8e9

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 18:39

Target

b966590375987e7ed2cc8034f7e6eef6.exe
Size

5.8MB
MD5

b966590375987e7ed2cc8034f7e6eef6
SHA1

e13515864c35f7c6e23cb9331aed6b9873dc9818
SHA256

3c4434bf2f85910265e7fc2e402088a7a42f7659ebeba7c163e260bd4935e8e9
SHA512

4bbe43165606a39dd3a68ebfa0633a99bf1426b7a17055e9ace6789ebafdb4a27e7b9cbe150285736c6d9fbc92dbdecce116d9ea146f226514cfb132702d2069
SSDEEP

98304:TLgmtrWUAyMioYpCxS5Kgg3gnl/IVUs1jePs6HqdfSO0dgg3gnl/IVUs1jePs:NpWPxEaS5egl/iBiP+d3Ygl/iBiP

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
4976	b966590375987e7ed2cc8034f7e6eef6.exe

Executes dropped EXE 1 IoCs

pid	Process
4976	b966590375987e7ed2cc8034f7e6eef6.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2804-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000400000001e980-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2804	b966590375987e7ed2cc8034f7e6eef6.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2804	b966590375987e7ed2cc8034f7e6eef6.exe
4976	b966590375987e7ed2cc8034f7e6eef6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 4976	2804	b966590375987e7ed2cc8034f7e6eef6.exe	89
PID 2804 wrote to memory of 4976	2804	b966590375987e7ed2cc8034f7e6eef6.exe	89
PID 2804 wrote to memory of 4976	2804	b966590375987e7ed2cc8034f7e6eef6.exe	89

C:\Users\Admin\AppData\Local\Temp\b966590375987e7ed2cc8034f7e6eef6.exe

Filesize
5.8MB

MD5
3b5199e34df8bb8f1501ab52035f018f

SHA1
86721649af787b83c43b3cc43c394846df08e7a6

SHA256
5e05bc88540797211815996897aa453b31e9eb1fab39fd689bddc8476fdf2bd2

SHA512
dccbc1846d04a9714dcc867a2c162d00cc2587742104fdfc8bfeb535af1bb8c5fe2fb41b07282bee6a5160e93f4f9e44468f9c749ddeda26c32b2d2b39c9a726

Download Submit
memory/2804-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2804-1-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/2804-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2804-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4976-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4976-13-0x0000000001C70000-0x0000000001DA3000-memory.dmp

Filesize
1.2MB

Download
memory/4976-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4976-20-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/4976-21-0x0000000005570000-0x000000000579A000-memory.dmp

Filesize
2.2MB

Download
memory/4976-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download