267e043bc214de8278fdc2b49d3d1427a382c2f12a13c42f4389da32b5a1a589

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 09:02

Target

dec92046a3aa28d0e0f7ecf7bbe2acc1.exe
Size

2.9MB
MD5

dec92046a3aa28d0e0f7ecf7bbe2acc1
SHA1

d5531ad9a3d5bd24c9923477d70b5969e64d6611
SHA256

267e043bc214de8278fdc2b49d3d1427a382c2f12a13c42f4389da32b5a1a589
SHA512

40b2790ee125e608fdcf35a2ab996af60eeafd2e4624b227fe2e6a2f5263bf01329cabe2dd6fd3760b1961d8f9f2ad827a3317383c93df3246f005c6e98bd891
SSDEEP

49152:yGrbEiE1QECdjMJ6V7ola9MSnCQIFP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:fFE1QbjMJqpxVIFgg3gnl/IVUs1jePs

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
1180	dec92046a3aa28d0e0f7ecf7bbe2acc1.exe

Executes dropped EXE 1 IoCs

pid	Process
1180	dec92046a3aa28d0e0f7ecf7bbe2acc1.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1604-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000800000001db2a-11.dat	upx
behavioral2/memory/1180-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1604	dec92046a3aa28d0e0f7ecf7bbe2acc1.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1604	dec92046a3aa28d0e0f7ecf7bbe2acc1.exe
1180	dec92046a3aa28d0e0f7ecf7bbe2acc1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1180	1604	dec92046a3aa28d0e0f7ecf7bbe2acc1.exe	96
PID 1604 wrote to memory of 1180	1604	dec92046a3aa28d0e0f7ecf7bbe2acc1.exe	96
PID 1604 wrote to memory of 1180	1604	dec92046a3aa28d0e0f7ecf7bbe2acc1.exe	96

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4372 --field-trial-handle=3488,i,1267426273081718772,6254127258555406296,262144 --variations-seed-version /prefetch:8
1⤵
PID:4248

C:\Users\Admin\AppData\Local\Temp\dec92046a3aa28d0e0f7ecf7bbe2acc1.exe

Filesize
2.9MB

MD5
8629bca9f24c53f53152f4d56ba49e48

SHA1
8f0f3a16a6e8030b42d351a81fadefb09bbdbbe1

SHA256
b360431b87ac54c3744ae824eaae9fd87ec107acdbb4311e500b364f27c8cef0

SHA512
36a3bbdd4586b12186d05eadd6aa255f4928ff32ac100c35dc4cb87b8048324bf79d2d3233e44773a97fc1c392bd7fc40b9cd08241bd0994147190c22294d876

Download Submit
memory/1180-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1180-14-0x0000000001D80000-0x0000000001EB3000-memory.dmp

Filesize
1.2MB

Download
memory/1180-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1180-20-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1180-22-0x0000000005680000-0x00000000058AA000-memory.dmp

Filesize
2.2MB

Download
memory/1180-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1604-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1604-1-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/1604-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1604-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download