1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:16

Target

1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
Size

41KB
MD5

6260eb8f66f79eb24188cd3df6994412
SHA1

e1a8e367c06644ddb8c003807d587d12ba25d724
SHA256

1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9
SHA512

b7361682db2c58a52fcc57f66ed320882a9f3919615f8c7bf0fb6d3c77332f4ae39fabb6395026e8fefaddc3b7899ab90ed18ea61385c6af01c7fab0b5488141
SSDEEP

768:WmNn7hiC8hT0zYmMUten89HuxLpxgKK3CU/OjSN:WmNn7hif0zYRUgnVJpxgKoCUdN

Score

9^/10

upx

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3316-0-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral2/memory/3316-3-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral2/memory/3316-4-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral2/memory/3316-5-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral2/memory/3316-10-0x0000000010000000-0x000000001000F000-memory.dmp	UPX

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3316-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3316-3-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3316-4-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3316-5-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3316-10-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe

description	pid	process	target process
PID 1848 wrote to memory of 3316	1848	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
PID 1848 wrote to memory of 3316	1848	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
PID 1848 wrote to memory of 3316	1848	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe

C:\Users\Admin\AppData\Local\Temp\1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
"C:\Users\Admin\AppData\Local\Temp\1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
  ?
  2⤵
  PID:3316

memory/1848-6-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3316-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3316-3-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3316-4-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3316-5-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3316-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3316-10-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download