18ff9f5d3a0f9355df8e556ef3e8f6cce3161dee7fb443a3a75140542685ba16

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 19:10

Target

18ff9f5d3a0f9355df8e556ef3e8f6cce3161dee7fb443a3a75140542685ba16.exe
Size

24KB
MD5

1ba9b6ed456c1ce50cc5feb0d1dfbfeb
SHA1

9123a8d9fb197f1a70c68a7d254518812ad3f4fb
SHA256

18ff9f5d3a0f9355df8e556ef3e8f6cce3161dee7fb443a3a75140542685ba16
SHA512

0ef5b259ed13a6d498b87c69876ffc19ac1dba52ed66fca00d95aeffc5c406dbd474b472e76e9f1b464cc9c35cc0ccef68774a2c54ac69bf497c708d79924a3b
SSDEEP

384:ErzPSOXRnvuxYrdyRnPR1aeXCYRKSxBKcilP2Y98h6gKvZ6BBslHIg6q43:ErzSOhnvuxNRn5VXfRLBmeMsT2Gx

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2356	rmass.exe

Loads dropped DLL 1 IoCs

pid	Process
1684	18ff9f5d3a0f9355df8e556ef3e8f6cce3161dee7fb443a3a75140542685ba16.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000d000000013309-1.dat	upx
behavioral1/memory/1684-2-0x0000000000020000-0x0000000000031000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rmass.exe	18ff9f5d3a0f9355df8e556ef3e8f6cce3161dee7fb443a3a75140542685ba16.exe
File created	C:\Windows\SysWOW64\rmass.exe	18ff9f5d3a0f9355df8e556ef3e8f6cce3161dee7fb443a3a75140542685ba16.exe

C:\Users\Admin\AppData\Local\Temp\18ff9f5d3a0f9355df8e556ef3e8f6cce3161dee7fb443a3a75140542685ba16.exe
"C:\Users\Admin\AppData\Local\Temp\18ff9f5d3a0f9355df8e556ef3e8f6cce3161dee7fb443a3a75140542685ba16.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:1684
- C:\Windows\SysWOW64\rmass.exe
  "C:\Windows\SysWOW64\rmass.exe"
  2⤵
  - Executes dropped EXE
  PID:2356

\Windows\SysWOW64\rmass.exe

Filesize
21KB

MD5
ebb20a5baac56f625dab58c94049c1b6

SHA1
43ec7801d6dfb5db7b3f76bd2c45aafba5ff65bc

SHA256
1b5b33d352c5cbe297ca4beb9fa2d6d5e7ef9091d321888219d009822bb2827b

SHA512
42d5940e36ec5bd8c5b8a6903e97051b30e3ea2694821fa7f42e5e8d57930512070e5d63671c92f5d6c83a6eb1166a199424c9fdb46548b8e41a0ade601014f5

Download Submit
memory/1684-2-0x0000000000020000-0x0000000000031000-memory.dmp

Filesize
68KB

Download
memory/1684-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download