c5be9caf7adf091d72f397330a85aae28838a20a9851abe0d90643d891dee5a4

Analysis

max time kernel
151s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 15:21

Target

bb9736f65ef8434554d7043f901362ea.exe
Size

2.9MB
MD5

bb9736f65ef8434554d7043f901362ea
SHA1

7cb50c8ed1b22b4119e80d31a58bc7863072e5ca
SHA256

c5be9caf7adf091d72f397330a85aae28838a20a9851abe0d90643d891dee5a4
SHA512

fb996c59e30a086e05acde721ad8d36164085ea038adedd24722b8951866f99797cfaca5f9e7187c7be3267c0e7bd82381995a462864309676f5622d83b9d38a
SSDEEP

49152:R/UV6xZLUH55vL15FhhnIddrdP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:R/UYxZLSvL15FbIddZgg3gnl/IVUs1jl

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
5024	bb9736f65ef8434554d7043f901362ea.exe

Executes dropped EXE 1 IoCs

pid	Process
5024	bb9736f65ef8434554d7043f901362ea.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2356-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000800000002322c-11.dat	upx
behavioral2/memory/5024-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2356	bb9736f65ef8434554d7043f901362ea.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2356	bb9736f65ef8434554d7043f901362ea.exe
5024	bb9736f65ef8434554d7043f901362ea.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 5024	2356	bb9736f65ef8434554d7043f901362ea.exe	89
PID 2356 wrote to memory of 5024	2356	bb9736f65ef8434554d7043f901362ea.exe	89
PID 2356 wrote to memory of 5024	2356	bb9736f65ef8434554d7043f901362ea.exe	89

C:\Users\Admin\AppData\Local\Temp\bb9736f65ef8434554d7043f901362ea.exe

Filesize
2.9MB

MD5
e2ba7f201fc05244af27fb46fe7ff685

SHA1
ee23ed56e3ba7d6aaa58b85ee0aebdb12a717790

SHA256
6d3fe3c072d1b99a35662aca5e174f6062e155f0b91e8737366254ce93429dc0

SHA512
168a0e2bd852297e94e0396a11996e12264692290d13eba1b1e94f9250d7d28753f6eeb7c211d873f23431aa1d0068574f84a75acb7bc0f07059d52cc562074b

Download Submit
memory/2356-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2356-1-0x0000000001C70000-0x0000000001DA3000-memory.dmp

Filesize
1.2MB

Download
memory/2356-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2356-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/5024-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/5024-15-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/5024-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/5024-20-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/5024-21-0x00000000056C0000-0x00000000058EA000-memory.dmp

Filesize
2.2MB

Download
memory/5024-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download