f8c024fab0cc15e7a94d5caf4cf4f09acda9a8c1ee646e5c720b3d2f3c0a2ed8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 09:32

Target

c84906a84e9aa6e7a6c8bbf3e90057f0.exe
Size

2.7MB
MD5

c84906a84e9aa6e7a6c8bbf3e90057f0
SHA1

8b65ac6834b2c2873ae7082c0489a07953d77ab7
SHA256

f8c024fab0cc15e7a94d5caf4cf4f09acda9a8c1ee646e5c720b3d2f3c0a2ed8
SHA512

9aacae8eb9e63ff48986cbe94bec81c49fc8449e92db590b58f0faf1346f67cf9399b162d82f321caadfb0b0a9b6902485cb9a4286acd31562346de290579aad
SSDEEP

49152:693WxQmJ19Pl3n3cIhv6ov5x0SYbLq0R93qO3pYdArFXgt7+4CTDammv7uBQQT3c:6UP3r3n3cIhv5v5wPvH3xQAJgENKThzZ

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2992	c84906a84e9aa6e7a6c8bbf3e90057f0.exe

Executes dropped EXE 1 IoCs

pid	Process
2992	c84906a84e9aa6e7a6c8bbf3e90057f0.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/920-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral2/memory/2992-12-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral2/files/0x00090000000224e9-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
920	c84906a84e9aa6e7a6c8bbf3e90057f0.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
920	c84906a84e9aa6e7a6c8bbf3e90057f0.exe
2992	c84906a84e9aa6e7a6c8bbf3e90057f0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 2992	920	c84906a84e9aa6e7a6c8bbf3e90057f0.exe	90
PID 920 wrote to memory of 2992	920	c84906a84e9aa6e7a6c8bbf3e90057f0.exe	90
PID 920 wrote to memory of 2992	920	c84906a84e9aa6e7a6c8bbf3e90057f0.exe	90

C:\Users\Admin\AppData\Local\Temp\c84906a84e9aa6e7a6c8bbf3e90057f0.exe

Filesize
2.7MB

MD5
a576c99171513623dedf7bada3a1de05

SHA1
11daba2dd78dd63dcc8a6894a1bf02874122c2fa

SHA256
52c6fcdc9dd6065200091c438bfeea7bb4d5b2314bc38ee8768ce0fd3122682f

SHA512
461ee5a59c164a7aadb9a283b6be25105552216b922d2cc82ad573ac94d9dddb075c7751e6d525b2e0e6fc7bca872fc3963b87ce7f63004e047ba07893d21c3b

Download Submit
memory/920-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/920-1-0x00000000018F0000-0x0000000001A21000-memory.dmp

Filesize
1.2MB

Download
memory/920-2-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/920-13-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2992-12-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2992-14-0x00000000018F0000-0x0000000001A21000-memory.dmp

Filesize
1.2MB

Download
memory/2992-15-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2992-20-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2992-21-0x0000000005590000-0x00000000057B2000-memory.dmp

Filesize
2.1MB

Download
memory/2992-28-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download