18ff9f5d3a0f9355df8e556ef3e8f6cce3161dee7fb443a3a75140542685ba16

Analysis

max time kernel
139s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 19:10

Target

18ff9f5d3a0f9355df8e556ef3e8f6cce3161dee7fb443a3a75140542685ba16.exe
Size

24KB
MD5

1ba9b6ed456c1ce50cc5feb0d1dfbfeb
SHA1

9123a8d9fb197f1a70c68a7d254518812ad3f4fb
SHA256

18ff9f5d3a0f9355df8e556ef3e8f6cce3161dee7fb443a3a75140542685ba16
SHA512

0ef5b259ed13a6d498b87c69876ffc19ac1dba52ed66fca00d95aeffc5c406dbd474b472e76e9f1b464cc9c35cc0ccef68774a2c54ac69bf497c708d79924a3b
SSDEEP

384:ErzPSOXRnvuxYrdyRnPR1aeXCYRKSxBKcilP2Y98h6gKvZ6BBslHIg6q43:ErzSOhnvuxNRn5VXfRLBmeMsT2Gx

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2308	rmass.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2308-3-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/files/0x000d000000023b26-2.dat	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rmass.exe	18ff9f5d3a0f9355df8e556ef3e8f6cce3161dee7fb443a3a75140542685ba16.exe
File created	C:\Windows\SysWOW64\rmass.exe	18ff9f5d3a0f9355df8e556ef3e8f6cce3161dee7fb443a3a75140542685ba16.exe

C:\Users\Admin\AppData\Local\Temp\18ff9f5d3a0f9355df8e556ef3e8f6cce3161dee7fb443a3a75140542685ba16.exe
"C:\Users\Admin\AppData\Local\Temp\18ff9f5d3a0f9355df8e556ef3e8f6cce3161dee7fb443a3a75140542685ba16.exe"
1⤵
- Drops file in System32 directory
PID:1664
- C:\Windows\SysWOW64\rmass.exe
  "C:\Windows\SysWOW64\rmass.exe"
  2⤵
  - Executes dropped EXE
  PID:2308

C:\Windows\SysWOW64\rmass.exe

Filesize
21KB

MD5
ebb20a5baac56f625dab58c94049c1b6

SHA1
43ec7801d6dfb5db7b3f76bd2c45aafba5ff65bc

SHA256
1b5b33d352c5cbe297ca4beb9fa2d6d5e7ef9091d321888219d009822bb2827b

SHA512
42d5940e36ec5bd8c5b8a6903e97051b30e3ea2694821fa7f42e5e8d57930512070e5d63671c92f5d6c83a6eb1166a199424c9fdb46548b8e41a0ade601014f5

Download Submit
memory/1664-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2308-3-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download