1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:16

Target

1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
Size

41KB
MD5

6260eb8f66f79eb24188cd3df6994412
SHA1

e1a8e367c06644ddb8c003807d587d12ba25d724
SHA256

1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9
SHA512

b7361682db2c58a52fcc57f66ed320882a9f3919615f8c7bf0fb6d3c77332f4ae39fabb6395026e8fefaddc3b7899ab90ed18ea61385c6af01c7fab0b5488141
SSDEEP

768:WmNn7hiC8hT0zYmMUten89HuxLpxgKK3CU/OjSN:WmNn7hif0zYRUgnVJpxgKoCUdN

Score

9^/10

upx

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2380-5-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral1/memory/2380-6-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral1/memory/2380-4-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral1/memory/2380-1-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral1/memory/2380-9-0x0000000010000000-0x000000001000F000-memory.dmp	UPX

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2380-5-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2380-6-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2380-4-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2380-1-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2380-9-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe

description	pid	process	target process
PID 2940 wrote to memory of 2380	2940	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
PID 2940 wrote to memory of 2380	2940	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
PID 2940 wrote to memory of 2380	2940	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
PID 2940 wrote to memory of 2380	2940	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe

C:\Users\Admin\AppData\Local\Temp\1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
"C:\Users\Admin\AppData\Local\Temp\1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Local\Temp\1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
  ?
  2⤵
  PID:2380

memory/2380-5-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2380-6-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2380-4-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2380-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2380-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2380-9-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2940-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download