c2bbf6fe638c36c001d5d62cc0e49664e446517407a54911db57552adb118aa8

Analysis

max time kernel
166s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 00:49

Target
SuperDeath2.exe
Size 7.3MB
Sample240318-a6gz1aca83
SHA256 9c027063879df3d477e9092a187c306c7d20eba956cf7517423d8eb2ad5960f2
MD5 391942faa157675018a6d26b6c631011
SHA1 5dd90332e1e1d632fd6e63f9aa2024e667aa5cd5
SHA512 debba49b7fbab85f099e5ff10bd2c75105166f20eb63b058d580e9043f33f272f80096bbce181f71d2476b1fd8059d386c28435a032bfca7210d2cf36f007e4e
SSDEEP 196608:GJXjwzfuuvf08BjSDLpiWA/HTIKUI7RVt:KwzfuqBuDLpiWAfbR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4996-0-0x0000000000400000-0x00000000014D4000-memory.dmp	upx
behavioral2/memory/4996-1-0x0000000000400000-0x00000000014D4000-memory.dmp	upx
behavioral2/memory/4996-43-0x0000000000400000-0x00000000014D4000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 3328	4996	SuperDeath2.exe	102
PID 4996 wrote to memory of 3328	4996	SuperDeath2.exe	102
PID 4996 wrote to memory of 3328	4996	SuperDeath2.exe	102

C:\Users\Admin\AppData\Local\Temp\SuperDeath2.exe
"C:\Users\Admin\AppData\Local\Temp\SuperDeath2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\917D.tmp\SuperDeath2.cmd""
  2⤵
  PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:680

SuperDeath2.cmd

Path C:\Users\Admin\AppData\Local\Temp\917D.tmp\SuperDeath2.cmd
Size 7KB
SHA256 e0fa759bb269ad38b6ed2008d4c39cd6a1a90193dfb6de08fda3962891e2e7eb
MD5 0e0804581819d046ebe00f29bdfe77f8
SHA1 a26e8857bb83dc27ed665a91bceb2d70f34a6f5f
SHA512 523841566918822f474074e163ca3f9abdfab83b851b1959866757ea0e4d5b08f2d2dd89e807edf8c51655a119b9c0dfb92fb22a7a8e05783b32e326a7f4dc11
SSDEEP 48:5T25wj5AU2ZzR+8O6zKSR1XR9TApZlzAXSolGDrbwvut3:5T25yazw8jzfXXR9TApZ5WlGnbjt3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4996-0-0x0000000000400000-0x00000000014D4000-memory.dmp

Download

memory/4996-1-0x0000000000400000-0x00000000014D4000-memory.dmp

Download

memory/4996-43-0x0000000000400000-0x00000000014D4000-memory.dmp

Download