6d24b6db34bc3c992aa1fc6687e510045ae011a3bd5ece2014e1537ce94a959d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:54

Target

6d24b6db34bc3c992aa1fc6687e510045ae011a3bd5ece2014e1537ce94a959d.exe
Size

18KB
MD5

ed1ae07b7d6427b089800171908055e1
SHA1

299569646d38cefe6ec1fc38b37fd46b3feff03f
SHA256

6d24b6db34bc3c992aa1fc6687e510045ae011a3bd5ece2014e1537ce94a959d
SHA512

91605d6d71df51cd8b3de1c0a97d6681b82f0628a2ee023eb421422e4cf279e118fcf1b77ac1c34bf1cb7482dfe2b5489bcf1a3821f4b59f198d48cd53a405c5
SSDEEP

384:tfI9h5Bx8MlUktE1uE+6vcbV4A2XyyTfGD15GbaGY3+rJg80wgYFLR:tGhd8hkC1tEbV4NQD18Y36H0wRFLR

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1672-0-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/1672-2-0x0000000000400000-0x000000000041A000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1672-0-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1672-2-0x0000000000400000-0x000000000041A000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

Processes:

6d24b6db34bc3c992aa1fc6687e510045ae011a3bd5ece2014e1537ce94a959d.exe

pid process

1672 6d24b6db34bc3c992aa1fc6687e510045ae011a3bd5ece2014e1537ce94a959d.exe

pid	process
1672	6d24b6db34bc3c992aa1fc6687e510045ae011a3bd5ece2014e1537ce94a959d.exe

C:\Users\Admin\AppData\Local\Temp\6d24b6db34bc3c992aa1fc6687e510045ae011a3bd5ece2014e1537ce94a959d.exe
"C:\Users\Admin\AppData\Local\Temp\6d24b6db34bc3c992aa1fc6687e510045ae011a3bd5ece2014e1537ce94a959d.exe"
1⤵
- Suspicious behavior: RenamesItself
PID:1672

memory/1672-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1672-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download