9b96c7c69284bfb72bd5a75664a9ebe2ea9616a5cef019c59580571b9cdf891d

Analysis

max time kernel
160s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 19:30

Target

c96e5e3909f2c24ea0659c33d095424a.exe
Size

1.5MB
MD5

c96e5e3909f2c24ea0659c33d095424a
SHA1

efec312790df35446d452a4ff9a539c08b337775
SHA256

9b96c7c69284bfb72bd5a75664a9ebe2ea9616a5cef019c59580571b9cdf891d
SHA512

de84a6252636f6a6550534990d5ec4b474a6b42a023d2da9e391a6f76b3ad36b20c83cf3e6b875ea5ebdcc578eb272f5aceb805573e44fec9175d3ea7cc643cc
SSDEEP

24576:YswlBBSwMhstXhS5O+7nmoNGPf0498fa1FW4WCqhIMcPHyw3zEVcsyXixW:EBBSwF08wnjof04p1F7/ZyDcsyA

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2852	c96e5e3909f2c24ea0659c33d095424a.exe

Executes dropped EXE 1 IoCs

pid	Process
2852	c96e5e3909f2c24ea0659c33d095424a.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3924-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000800000001db2a-11.dat	upx
behavioral2/memory/2852-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3924	c96e5e3909f2c24ea0659c33d095424a.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3924	c96e5e3909f2c24ea0659c33d095424a.exe
2852	c96e5e3909f2c24ea0659c33d095424a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 2852	3924	c96e5e3909f2c24ea0659c33d095424a.exe	95
PID 3924 wrote to memory of 2852	3924	c96e5e3909f2c24ea0659c33d095424a.exe	95
PID 3924 wrote to memory of 2852	3924	c96e5e3909f2c24ea0659c33d095424a.exe	95

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3660 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
PID:4504

C:\Users\Admin\AppData\Local\Temp\c96e5e3909f2c24ea0659c33d095424a.exe

Filesize
192KB

MD5
aa9733b0002a8dc5ad77737cb95776a0

SHA1
05b7ed2b149bc788dedc0562e82310750ec2de20

SHA256
f3d1f61fa7e3e4a5027eaf849a2582410bd723a6a93803526defd079d6a256f0

SHA512
9c1132a9636a53a731534e7fd3e1d99c06ce6f771a82c1f0a211f3a9284dac3bcc08905126e1610bb3e8022a7e21036b1c709797924659c900710503311939fe

Download Submit
memory/2852-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2852-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2852-15-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/2852-21-0x0000000005650000-0x000000000587A000-memory.dmp

Filesize
2.2MB

Download
memory/2852-20-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2852-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3924-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3924-1-0x0000000001BF0000-0x0000000001D23000-memory.dmp

Filesize
1.2MB

Download
memory/3924-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3924-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download