d1c91f347ea28557fa52652206d9ffbe55a1da28e0fc4f62ec230d0d410fd533

Analysis

max time kernel
159s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 14:22

Target

c6193d5611523a786a867070315db79d.exe
Size

11.7MB
MD5

c6193d5611523a786a867070315db79d
SHA1

2d29ccf91441286e2ab89d58beeb5c5f69bf9455
SHA256

d1c91f347ea28557fa52652206d9ffbe55a1da28e0fc4f62ec230d0d410fd533
SHA512

4f80f3f09cf787954e9c71c3006674b0b447042fa293a10ad59d8b8e46eaff7d4f9a56383b23221dfd957c406d0978a236223c30066a0901d37882aabcf4cfa9
SSDEEP

196608:dkjjgl/iBiPvwsYWDPgl/iBiPVDAWkgl/iBiPvwsYWDPgl/iBiP:dkjj2imwsYWDP2i4k2imwsYWDP2i

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
848	c6193d5611523a786a867070315db79d.exe

Executes dropped EXE 1 IoCs

pid	Process
848	c6193d5611523a786a867070315db79d.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/512-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000700000002321d-11.dat	upx
behavioral2/memory/848-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
512	c6193d5611523a786a867070315db79d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
512	c6193d5611523a786a867070315db79d.exe
848	c6193d5611523a786a867070315db79d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 848	512	c6193d5611523a786a867070315db79d.exe	89
PID 512 wrote to memory of 848	512	c6193d5611523a786a867070315db79d.exe	89
PID 512 wrote to memory of 848	512	c6193d5611523a786a867070315db79d.exe	89

C:\Users\Admin\AppData\Local\Temp\c6193d5611523a786a867070315db79d.exe

Filesize
6.9MB

MD5
c8e79b79cd86810660db60880cce2285

SHA1
308a6e59728a5d91c37500dad009ac7721091d1c

SHA256
dcb3feab374d5e4fb8471327b1b517e8bca92fe3650142bf9760b6637e7386d3

SHA512
da2dbdc35c78eac2f388fc1acad36aadac50dc5e061be4541411beba151690789b1eb41434091b18158c5f8bc9a913a9f3b6c5cfa9806b4d2020afc48d57886a

Download Submit
memory/512-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/512-1-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/512-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/512-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/848-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/848-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/848-15-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/848-20-0x0000000005680000-0x00000000058AA000-memory.dmp

Filesize
2.2MB

Download
memory/848-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/848-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download