04d7e3f585998cb196abee26168a5c68877a36dee380c07e773cd3fa319b47da

Analysis

max time kernel
92s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 18:16

Target

04d7e3f585998cb196abee26168a5c68877a36dee380c07e773cd3fa319b47da.exe
Size

104KB
MD5

a2d69936739d237cc50db22ad0489507
SHA1

596a335ed744ed997b5d28597b2514a2f6cb4b63
SHA256

04d7e3f585998cb196abee26168a5c68877a36dee380c07e773cd3fa319b47da
SHA512

e076c3f38cd7b325501490b001cb7729e8b6dccf9bbbd346efd86267abacb091ea39e4e3d775e1fa6514adc01d14ef574b03b2704e4bc83c3ba79b73b267c565
SSDEEP

3072:rgn/uMElX50flY95ro+udfLC38YCtmNjYp6VRS:UnhU5s1CMYCtvMVs

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/4496-0-0x0000000000400000-0x0000000000464000-memory.dmp	UPX
behavioral2/files/0x000a000000023146-5.dat	UPX

Executes dropped EXE 1 IoCs

pid	Process
4864	hdxpvzc.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4496-0-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral2/files/0x000a000000023146-5.dat	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\hdxpvzc.exe	04d7e3f585998cb196abee26168a5c68877a36dee380c07e773cd3fa319b47da.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4916	4864	WerFault.exe	94

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4864	hdxpvzc.exe
4864	hdxpvzc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	hdxpvzc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 3552	4864	hdxpvzc.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3552
- C:\Users\Admin\AppData\Local\Temp\04d7e3f585998cb196abee26168a5c68877a36dee380c07e773cd3fa319b47da.exe
  "C:\Users\Admin\AppData\Local\Temp\04d7e3f585998cb196abee26168a5c68877a36dee380c07e773cd3fa319b47da.exe"
  2⤵
  - Drops file in Program Files directory
  PID:4496

C:\PROGRA~3\Mozilla\hdxpvzc.exe
C:\PROGRA~3\Mozilla\hdxpvzc.exe -ilrweca
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 556
  2⤵
  - Program crash
  PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4864 -ip 4864
1⤵
PID:4948

C:\PROGRA~3\Mozilla\hdxpvzc.exe

Filesize
104KB

MD5
d65654cd347e561e4c1ad645e21bc84e

SHA1
75a5182cd26626b43f9cf30f5b2a1641c9bd6211

SHA256
60ba304ea405e5a4377f53924b0d2e89db45fdb04abbc5fd488483d7ddeaeb71

SHA512
6f71dca1b7c715e42cb13a0bcc3557d746019b14066cb32e5ac0a36e6dc75c4ad12eb821bddd3eeeb93ad2b493f0db04d515c8322223f4bd2710eda1f02cfd08

Download Submit
memory/3552-10-0x00000000027A0000-0x00000000027BC000-memory.dmp

Filesize
112KB

Download
memory/4496-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4496-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4496-1-0x0000000000960000-0x00000000009BF000-memory.dmp

Filesize
380KB

Download
memory/4496-7-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4864-8-0x00000000005A0000-0x00000000005FF000-memory.dmp

Filesize
380KB

Download
memory/4864-9-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4864-12-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download