977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:53

Target

977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe
Size

59KB
MD5

0a519451c0795cf2c66b8164cb0f8782
SHA1

0b7e97b8a57c699e9d50c6e2138bd1c3c2e6093a
SHA256

977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068
SHA512

ce35fc344135eaae88c225665e75f6f3aa48b9d4306d518ab95b346db65468c97cc855acdc6f71de69a37652bb12f34affa9e144c34a241310b557c6cd9056dd
SSDEEP

768:L3wXk6mU7159gO1Wy8D8h5S94K/RA/WBbEJFPNMU6kN6wi+V7+Pjm/Qx8R1:L3ofmU7r/Cwh5ARA/WYdNRN6WVR/+

Score

7^/10

upx

Deletes itself 1 IoCs

Processes:

977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

pid process

2944 977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe
Executes dropped EXE 1 IoCs

Processes:

977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

pid process

2944 977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe
Loads dropped DLL 1 IoCs

Processes:

977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

pid process

1848 977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

pid	process
2944	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

pid	process
2944	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1848-0-0x0000000000400000-0x000000000043D000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe	upx

Suspicious behavior: RenamesItself 1 IoCs

Processes:

977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

pid process

1848 977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

pid	process
1848	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe
2944	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

description	pid	process	target process
PID 1848 wrote to memory of 2944	1848	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe
PID 1848 wrote to memory of 2944	1848	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe
PID 1848 wrote to memory of 2944	1848	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe
PID 1848 wrote to memory of 2944	1848	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

C:\Users\Admin\AppData\Local\Temp\977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe
Filesize
59KB

MD5
bab0e35f2050a0e482398e347648c22d

SHA1
ddc3b53a80631f9aab6634087f432f460721323b

SHA256
8a48746bb350e19fc2a7086fe02f98bb58e4ae3e2abc2e845c83ffb45290f8bf

SHA512
7632d989ceff410bf68b1f2052d4c5823f337e9ff2998a0005b578e22365900207364d1f1f3c2a440b5608059331bf68bedb32bfdc69d65d40b0f366bf302b98

Download Submit
memory/1848-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1848-14-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1848-9-0x0000000000030000-0x000000000003F000-memory.dmp

Filesize
60KB

Download
memory/1848-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2944-17-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2944-23-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2944-22-0x0000000000030000-0x000000000003F000-memory.dmp

Filesize
60KB

Download
memory/2944-16-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2944-28-0x00000000002F0000-0x000000000030D000-memory.dmp

Filesize
116KB

Download
memory/2944-29-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download