4986b6ca13fc903ff7154a1e4ef2d00492db568396a7b2cee5efbeb67a6300d1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 13:01

Target

de135c559901c9029cf86b9ca9cf2b0b.exe
Size

82KB
MD5

de135c559901c9029cf86b9ca9cf2b0b
SHA1

2e29d1c2b1daa3e7889a7d7848e56d395f2bdccc
SHA256

4986b6ca13fc903ff7154a1e4ef2d00492db568396a7b2cee5efbeb67a6300d1
SHA512

b686d742c1863391e68c3ab5e2fc03656dfb64633a43d73398c3237ae5fcbc3d3635801acb7669b6677ad0f245916fff083a208c7c03315d04f5d0f31616e088
SSDEEP

1536:JUayq9tU7BC3zqz77QeWiG6+X5+yURdzA2/mKfOk6LCVCIK7LQ184ocy:JU8aWQ7nEZFUwUm44eCIg818Uy

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2356-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2356-1-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	de135c559901c9029cf86b9ca9cf2b0b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\juylo	de135c559901c9029cf86b9ca9cf2b0b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\juylo	de135c559901c9029cf86b9ca9cf2b0b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	de135c559901c9029cf86b9ca9cf2b0b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	de135c559901c9029cf86b9ca9cf2b0b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	de135c559901c9029cf86b9ca9cf2b0b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\juylo\\command	de135c559901c9029cf86b9ca9cf2b0b.exe

C:\Users\Admin\AppData\Local\Temp\de135c559901c9029cf86b9ca9cf2b0b.exe
"C:\Users\Admin\AppData\Local\Temp\de135c559901c9029cf86b9ca9cf2b0b.exe"
1⤵
- Modifies registry class
PID:2356

memory/2356-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2356-1-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download